CVE-2007-5333: Infoleak
Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-5333?
CVE-2007-5333 is considered a high severity vulnerability due to the potential leakage of sensitive information such as session IDs.
How do I fix CVE-2007-5333?
To fix CVE-2007-5333, upgrade Apache Tomcat to a version higher than 6.0.14, 5.5.25, or 4.1.36.
What versions of Apache Tomcat are affected by CVE-2007-5333?
CVE-2007-5333 affects Apache Tomcat versions 4.1.0 through 4.1.36, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14.
What type of information can be leaked through CVE-2007-5333?
CVE-2007-5333 may allow sensitive information, including session IDs, to be leaked to remote attackers.
Is CVE-2007-5333 a local or remote vulnerability?
CVE-2007-5333 is classified as a remote vulnerability, allowing attackers to exploit it from a distance.