NVD

Id
55537  
Name
CVE-2007-3385  
Description
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the " character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-07  
Published
2007-08-14  
Modified Date
2011-04-20  
Seq
2007-3385  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
282272 55537 CVE-2007-3385 http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx  View
282273 55537 CVE-2007-3385 SSRT071447  View
282274 55537 CVE-2007-3385 SSRT071472  View
282275 55537 CVE-2007-3385 APPLE-SA-2008-06-30  View
282276 55537 CVE-2007-3385 SUSE-SR:2008:005  View
282277 55537 CVE-2007-3385 SUSE-SR:2009:004  View
282278 55537 CVE-2007-3385 oval:org.mitre.oval:def:9549  View
282279 55537 CVE-2007-3385 3011  View
282280 55537 CVE-2007-3385 1018557  View
282281 55537 CVE-2007-3385 http://support.apple.com/kb/HT2163  View
282282 55537 CVE-2007-3385 http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540  View
282283 55537 CVE-2007-3385 http://tomcat.apache.org/security-6.html  View
282284 55537 CVE-2007-3385 IZ55562  View
282285 55537 CVE-2007-3385 DSA-1447  View
282286 55537 CVE-2007-3385 DSA-1453  View
282287 55537 CVE-2007-3385 VU#993544  View
282288 55537 CVE-2007-3385 MDKSA-2007:241  View
282289 55537 CVE-2007-3385 RHSA-2007:0871  View
282290 55537 CVE-2007-3385 RHSA-2007:0950  View
282291 55537 CVE-2007-3385 RHSA-2008:0195  View
282292 55537 CVE-2007-3385 RHSA-2008:0261  View
282293 55537 CVE-2007-3385 20070814 CVE-2007-3385: Handling of " in cookies  View
282294 55537 CVE-2007-3385 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities  View
282295 55537 CVE-2007-3385 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)  View
282296 55537 CVE-2007-3385 25316  View
282297 55537 CVE-2007-3385 ADV-2007-2902  View
282298 55537 CVE-2007-3385 ADV-2007-3386  View
282299 55537 CVE-2007-3385 ADV-2007-3527  View
282300 55537 CVE-2007-3385 ADV-2008-1981  View
282301 55537 CVE-2007-3385 ADV-2009-0233  View
282302 55537 CVE-2007-3385 tomcat-slashcookie-information-disclosure(35999)  View
282303 55537 CVE-2007-3385 FEDORA-2007-3456  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
51934 JVNDB-2007-000597 Apache Tomcat における「」の取り扱い不備によりセッションハイジャック攻撃に利用される脆弱性 Apache Tomcat には、クッキーにおける区切り文字の、バックスラッシュ「」の取り扱いに不備が存在するために、セッションデータの ID などの重要な情報を奪取され、セッションハイジャック攻撃に利用される脆弱性が存在します。 CVE-2007-3385 26740 CVE-2007-3385 55537 4.3 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-000597.html 2007-08-14 2008-07-11 View