Versio.io

CVE-2007-5333

Common vulnerabilities & exposures (CVE)

CVE databaseCVE database blogpostRelease & EoL database
 
Published at: - 12-02-2008 02:00
Last modified: - 03-02-2022 08:42
Total changes: - 2

Description

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.

Common Vulnerability Scoring System (CVSS)

AV:N/AC:L/Au:N/C:P/I:N/A:N
Low
Attack complexity
Network
Attack vector
None
Availability
Low
Confidentiality
None
Integrity
-
Privileges required
-
Scope
-
User interaction
5.0
Base score
10.0
2.9
Exploitability score
Impact score
 

Verification logic

OR
vendor=apache AND product=Tomcat AND versionEndIncluding=4.1.36 AND versionStartIncluding=4.1.0
vendor=apache AND product=Tomcat AND versionEndIncluding=5.5.25 AND versionStartIncluding=5.5.0
vendor=apache AND product=Tomcat AND versionEndIncluding=6.0.14 AND versionStartIncluding=6.0.0
 

Reference

 


Keywords

NVD

 

CVE-2007-5333

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures

 

We use cookies to ensure that we give you the best experience on our website. Read privacy policies for more information.