NVD

Id
55534  
Name
CVE-2007-3382  
Description
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes (""") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-07  
Published
2007-08-14  
Modified Date
2011-03-07  
Seq
2007-3382  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
282224 55534 CVE-2007-3382 http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx  View
282225 55534 CVE-2007-3382 SSRT071447  View
282226 55534 CVE-2007-3382 SSRT071472  View
282227 55534 CVE-2007-3382 APPLE-SA-2008-06-30  View
282228 55534 CVE-2007-3382 SUSE-SR:2008:005  View
282229 55534 CVE-2007-3382 SUSE-SR:2009:004  View
282230 55534 CVE-2007-3382 oval:org.mitre.oval:def:11269  View
282231 55534 CVE-2007-3382 1018556  View
282232 55534 CVE-2007-3382 http://support.apple.com/kb/HT2163  View
282233 55534 CVE-2007-3382 http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540  View
282234 55534 CVE-2007-3382 http://tomcat.apache.org/security-6.html  View
282235 55534 CVE-2007-3382 IZ55562  View
282236 55534 CVE-2007-3382 DSA-1447  View
282237 55534 CVE-2007-3382 DSA-1453  View
282238 55534 CVE-2007-3382 VU#993544  View
282239 55534 CVE-2007-3382 MDKSA-2007:241  View
282240 55534 CVE-2007-3382 RHSA-2007:0871  View
282241 55534 CVE-2007-3382 RHSA-2007:0950  View
282242 55534 CVE-2007-3382 RHSA-2008:0195  View
282243 55534 CVE-2007-3382 RHSA-2008:0261  View
282244 55534 CVE-2007-3382 20070814 CVE-2007-3382: Handling of cookies containing a " character  View
282245 55534 CVE-2007-3382 20070814 Re: CVE-2007-3382: Handling of cookies containing a " character  View
282246 55534 CVE-2007-3382 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities  View
282247 55534 CVE-2007-3382 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)  View
282248 55534 CVE-2007-3382 25316  View
282249 55534 CVE-2007-3382 ADV-2007-2902  View
282250 55534 CVE-2007-3382 ADV-2007-3386  View
282251 55534 CVE-2007-3382 ADV-2007-3527  View
282252 55534 CVE-2007-3382 ADV-2008-1981  View
282253 55534 CVE-2007-3382 ADV-2009-0233  View
282254 55534 CVE-2007-3382 tomcat-quotecookie-information-disclosure(36006)  View
282255 55534 CVE-2007-3382 FEDORA-2007-3456  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
51933 JVNDB-2007-000596 Apache Tomcat における「"」の取り扱い不備によりセッションハイジャック攻撃に利用される脆弱性 Apache Tomcat には、クッキーにおける区切り文字の、シングルクオート「"」の取り扱いに不備が存在するために、セッションデータの ID などの重要な情報を奪取され、セッションハイジャック攻撃に利用される脆弱性が存在します。 CVE-2007-3382 26737 CVE-2007-3382 55534 4.3 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-000596.html 2007-08-14 2008-07-11 View