Advisory details:
github_osv / GHSA-cww4-vj5r-rx57
| Advisory ID | github_osv/GHSA-cww4-vj5r-rx57 |
| Aliases |
CVE-2007-5333
|
| Summary | Exposure of Sensitive Information in Apache Tomcat Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| generic_textual | MODERATE |
| Data source | Exploit-DB |
|---|---|
| Date added | Feb. 9, 2008 |
| Description | Apache Tomcat 6.0.15 - Cookie Quote Handling Remote Information Disclosure |
| Ransomware campaign use | Known |
| Source publication date | Feb. 9, 2008 |
| Exploit type | remote |
| Platform | multiple |
| Source update date | Jan. 22, 2014 |
| Source URL | https://www.securityfocus.com/bid/27706/info |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no SSVC decisions available.