CVE-2007-3382

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 37.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-08-14 · updated 2026-06-16
Weakness: CWE-200

Description

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.

Affected products

Apache Tomcat: 3.3, 3.3.1, 3.3.1a, 3.3.2, 4.1.0, 4.1.1 (+79)

References

http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554
http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
http://secunia.com/advisories/26466
http://secunia.com/advisories/26898
http://secunia.com/advisories/27037
http://secunia.com/advisories/27267
http://secunia.com/advisories/27727
http://secunia.com/advisories/28317

Get alerted when CVE-2007-3382 or the next vulnerability affects your stack