Advisory details:
gitlab / maven/org.apache.tomcat/tomcat/CVE-2007-3382
| Advisory ID | gitlab/maven/org.apache.tomcat/tomcat/CVE-2007-3382 |
| Aliases |
CVE-2007-3382
GHSA-qff8-g48j-pwpw |
| Summary | Exposure of Sensitive Information to an Unauthorized Actor Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv2 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2007-3382.yml |
| Data source | Exploit-DB |
|---|---|
| Date added | Aug. 14, 2007 |
| Description | Apache Tomcat 6.0.13 - Insecure Cookie Handling Quote Delimiter Session ID Disclosure |
| Ransomware campaign use | Known |
| Source publication date | Aug. 14, 2007 |
| Exploit type | remote |
| Platform | multiple |
| Source update date | Dec. 25, 2013 |
| Source URL | https://www.securityfocus.com/bid/25316/info |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
There are no SSVC decisions available.