CVE-2007-3384

Apache Tomcat's CookieExample Vulnerable to XSS

4.3 Medium

Multiple cross-site scripting (XSS) vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Value field, related to error messages.

Exploit likelihood

3.17%Up 1.1 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2007-3384
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Updated: 2026-11-02

CVE List No score

Record: CVE-2007-3384
Updated: 2026-11-02

EUVDEUVD-2022-2121 No score

Record: EUVD-2022-2121
Updated: 2026-11-03

GitHub AdvisoriesGHSA-36hp-4x3g-phrg No score

Apache Tomcat's CookieExample Vulnerable to XSS

Multiple cross-site scripting (XSS) vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Value field, related to error messages.

Record: GHSA-36hp-4x3g-phrg
Weakness: CWE-80
Updated: 2026-11-02

OSVGHSA-36hp-4x3g-phrg No score

Apache Tomcat's CookieExample Vulnerable to XSS

Record: GHSA-36hp-4x3g-phrg
Weakness: CWE-80
Updated: 2026-11-02

Affected products

apache tomcat

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.tomcat:tomcat` Maven	3.3.0 to 3.3.2	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	affected, aliases, cwes, references, title	GitHub Advisories, OSV
Nov 2, 2026	first indexed	CVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-3384 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published August 8, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.17%, the 88th percentile. No source names a fixed version.

References

Show 6 moreShow less