CVE-2007-3385

Apache Tomcat Mishandles Character Sequence in Cookies

4.3 Medium

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the " character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.

Exploit likelihood

16.9%Up 9.6 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2007-3385
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Record: CVE-2007-3385
Updated: 2026-11-02

EUVDEUVD-2022-2811 No score

Record: EUVD-2022-2811
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6j8f-66vh-39mj No score

Apache Tomcat Mishandles Character Sequence in Cookies

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.

Record: GHSA-6j8f-66vh-39mj
Weakness: CWE-200
Updated: 2026-11-02

OSVGHSA-6j8f-66vh-39mj No score

Apache Tomcat Mishandles Character Sequence in Cookies

Record: GHSA-6j8f-66vh-39mj
Weakness: CWE-200
Updated: 2026-11-02

Affected products

apache tomcat

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.tomcat:tomcat` Maven	6.0.0 to 6.0.13	None known
`org.apache.tomcat:tomcat` Maven	5.5.0 to 5.5.24	None known
`org.apache.tomcat:tomcat` Maven	5.0.0 to 5.0.30	None known
`org.apache.tomcat:tomcat` Maven	4.1.0 to 4.1.36	None known
`org.apache.tomcat:tomcat` Maven	3.3.0 to 3.3.2	None known
`tomcat5.5` Debian:4.0 From an advisory covering 5 CVEs	before 5.5.20-2etch1, plus listed versions 5.5.20-2	5.5.20-2etch1
`tomcat5` Debian:4.0 From an advisory covering 3 CVEs	before 5.0.30-12etch1, plus listed versions 5.0.30-12	5.0.30-12etch1
`tomcat5` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-admin-webapps` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-common-lib` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5

Show 156 moreShow less

Affected packages
Package	Affected	Fixed
`tomcat5-debuginfo` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-jasper` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-jasper-javadoc` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-jsp-2.0-api-javadoc` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-server-lib` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-servlet-2.4-api-javadoc` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-webapps` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5` Red Hat:enterprise_linux:5::client From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-debuginfo` Red Hat:enterprise_linux:5::client From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-jsp-2.0-api` Red Hat:enterprise_linux:5::client From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-servlet-2.4-api` Red Hat:enterprise_linux:5::client From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5` Red Hat:enterprise_linux:5::server From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-admin-webapps` Red Hat:enterprise_linux:5::server From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-common-lib` Red Hat:enterprise_linux:5::server From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-debuginfo` Red Hat:enterprise_linux:5::server From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-jasper` Red Hat:enterprise_linux:5::server From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-jasper-javadoc` Red Hat:enterprise_linux:5::server From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-jsp-2.0-api` Red Hat:enterprise_linux:5::server From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-jsp-2.0-api-javadoc` Red Hat:enterprise_linux:5::server From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-server-lib` Red Hat:enterprise_linux:5::server From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-servlet-2.4-api` Red Hat:enterprise_linux:5::server From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-servlet-2.4-api-javadoc` Red Hat:enterprise_linux:5::server From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5-webapps` Red Hat:enterprise_linux:5::server From an advisory covering 3 CVEs	before 0:5.5.23-0jpp.3.0.2.el5	0:5.5.23-0jpp.3.0.2.el5
`tomcat5` Red Hat:rhel_application_server:2 From an advisory covering 6 CVEs	before 0:5.5.23-0jpp_4rh.4	0:5.5.23-0jpp_4rh.4
`tomcat5-admin-webapps` Red Hat:rhel_application_server:2 From an advisory covering 6 CVEs	before 0:5.5.23-0jpp_4rh.4	0:5.5.23-0jpp_4rh.4
`tomcat5-common-lib` Red Hat:rhel_application_server:2 From an advisory covering 6 CVEs	before 0:5.5.23-0jpp_4rh.4	0:5.5.23-0jpp_4rh.4
`tomcat5-jasper` Red Hat:rhel_application_server:2 From an advisory covering 6 CVEs	before 0:5.5.23-0jpp_4rh.4	0:5.5.23-0jpp_4rh.4
`tomcat5-jasper-javadoc` Red Hat:rhel_application_server:2 From an advisory covering 6 CVEs	before 0:5.5.23-0jpp_4rh.4	0:5.5.23-0jpp_4rh.4
`tomcat5-jsp-2.0-api` Red Hat:rhel_application_server:2 From an advisory covering 6 CVEs	before 0:5.5.23-0jpp_4rh.4	0:5.5.23-0jpp_4rh.4
`tomcat5-jsp-2.0-api-javadoc` Red Hat:rhel_application_server:2 From an advisory covering 6 CVEs	before 0:5.5.23-0jpp_4rh.4	0:5.5.23-0jpp_4rh.4
`tomcat5-server-lib` Red Hat:rhel_application_server:2 From an advisory covering 6 CVEs	before 0:5.5.23-0jpp_4rh.4	0:5.5.23-0jpp_4rh.4
`tomcat5-servlet-2.4-api` Red Hat:rhel_application_server:2 From an advisory covering 6 CVEs	before 0:5.5.23-0jpp_4rh.4	0:5.5.23-0jpp_4rh.4
`tomcat5-servlet-2.4-api-javadoc` Red Hat:rhel_application_server:2 From an advisory covering 6 CVEs	before 0:5.5.23-0jpp_4rh.4	0:5.5.23-0jpp_4rh.4
`tomcat5-webapps` Red Hat:rhel_application_server:2 From an advisory covering 6 CVEs	before 0:5.5.23-0jpp_4rh.4	0:5.5.23-0jpp_4rh.4
`berkeleydb` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:2.0.90-1jpp.ep1.1	0:2.0.90-1jpp.ep1.1
`hibernate3-annotations` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:3.2.1-1.patch01.1jpp.ep1.2	0:3.2.1-1.patch01.1jpp.ep1.2
`hibernate3-annotations-javadoc` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:3.2.1-1.patch01.1jpp.ep1.2	0:3.2.1-1.patch01.1jpp.ep1.2
`hibernate3-ejb-persistence-3.0-api` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:3.2.1-1jpp.ep1.1	0:3.2.1-1jpp.ep1.1
`hibernate3-ejb-persistence-3.0-api-javadoc` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:3.2.1-1jpp.ep1.1	0:3.2.1-1jpp.ep1.1
`hibernate3-entitymanager` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:3.2.1-1jpp.ep1.5	0:3.2.1-1jpp.ep1.5
`hibernate3-entitymanager-javadoc` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:3.2.1-1jpp.ep1.5	0:3.2.1-1jpp.ep1.5
`jacorb` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:2.3.0-1jpp.ep1.1	0:2.3.0-1jpp.ep1.1
`jboss-aop` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:1.5.5-0jpp.ep1.2.1	0:1.5.5-0jpp.ep1.2.1
`jboss-cache` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:1.4.1-1.SP3.1jpp.ep1.1	0:1.4.1-1.SP3.1jpp.ep1.1
`jboss-remoting` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:2.2.2-1jpp.ep1.4	0:2.2.2-1jpp.ep1.4
`jboss-seam` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:1.2.1-1.ep1.2	0:1.2.1-1.ep1.2
`jboss-seam-docs` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:1.2.1-1.ep1.2	0:1.2.1-1.ep1.2
`jboss-serialization` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:1.0.3-1jpp.ep1.3	0:1.0.3-1jpp.ep1.3
`jbossas` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:4.2.0-2.CP01.ep1.4	0:4.2.0-2.CP01.ep1.4
`jbossweb` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:2.0.0-2.CP01.0jpp.ep1.4	0:2.0.0-2.CP01.0jpp.ep1.4
`jbossxb` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:1.0.0-1.CP01.0jpp.ep1.1	0:1.0.0-1.CP01.0jpp.ep1.1
`jcommon` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:0.9.7-1jpp.el4ep1.1	0:0.9.7-1jpp.el4ep1.1
`jfreechart` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:0.9.21-2jpp.el4ep1.1	0:0.9.21-2jpp.el4ep1.1
`rh-eap-docs` Red Hat:rhel_application_stack:1 From an advisory covering 2 CVEs	before 0:4.2.0-2.CP01.ep1.2	0:4.2.0-2.CP01.ep1.2
`jakarta-commons-pool` Red Hat:network_satellite:4.0::el3 From an advisory covering 7 CVEs	before 0:1.2-2jpp_2rh	0:1.2-2jpp_2rh
`tomcat5` Red Hat:network_satellite:4.0::el3 From an advisory covering 7 CVEs	before 0:5.0.30-0jpp_6rh	0:5.0.30-0jpp_6rh
`tyrex` Red Hat:network_satellite:4.0::el3 From an advisory covering 7 CVEs	before 0:1.0.1-2jpp_2rh	0:1.0.1-2jpp_2rh
`jakarta-commons-pool` Red Hat:network_satellite:4.1::el3 From an advisory covering 7 CVEs	before 0:1.2-2jpp_2rh	0:1.2-2jpp_2rh
`tomcat5` Red Hat:network_satellite:4.1::el3 From an advisory covering 7 CVEs	before 0:5.0.30-0jpp_6rh	0:5.0.30-0jpp_6rh
`tyrex` Red Hat:network_satellite:4.1::el3 From an advisory covering 7 CVEs	before 0:1.0.1-2jpp_2rh	0:1.0.1-2jpp_2rh
`jakarta-commons-pool` Red Hat:network_satellite:4.2::el3 From an advisory covering 7 CVEs	before 0:1.2-2jpp_2rh	0:1.2-2jpp_2rh
`tomcat5` Red Hat:network_satellite:4.2::el3 From an advisory covering 7 CVEs	before 0:5.0.30-0jpp_6rh	0:5.0.30-0jpp_6rh
`tyrex` Red Hat:network_satellite:4.2::el3 From an advisory covering 7 CVEs	before 0:1.0.1-2jpp_2rh	0:1.0.1-2jpp_2rh
`jakarta-commons-pool` Red Hat:network_satellite:4.0::el4 From an advisory covering 7 CVEs	before 0:1.2-2jpp_2rh	0:1.2-2jpp_2rh
`tomcat5` Red Hat:network_satellite:4.0::el4 From an advisory covering 7 CVEs	before 0:5.0.30-0jpp_6rh	0:5.0.30-0jpp_6rh
`tyrex` Red Hat:network_satellite:4.0::el4 From an advisory covering 7 CVEs	before 0:1.0.1-2jpp_2rh	0:1.0.1-2jpp_2rh
`jakarta-commons-pool` Red Hat:network_satellite:4.1::el4 From an advisory covering 7 CVEs	before 0:1.2-2jpp_2rh	0:1.2-2jpp_2rh
`tomcat5` Red Hat:network_satellite:4.1::el4 From an advisory covering 7 CVEs	before 0:5.0.30-0jpp_6rh	0:5.0.30-0jpp_6rh
`tyrex` Red Hat:network_satellite:4.1::el4 From an advisory covering 7 CVEs	before 0:1.0.1-2jpp_2rh	0:1.0.1-2jpp_2rh
`jakarta-commons-pool` Red Hat:network_satellite:4.2::el4 From an advisory covering 7 CVEs	before 0:1.2-2jpp_2rh	0:1.2-2jpp_2rh
`tomcat5` Red Hat:network_satellite:4.2::el4 From an advisory covering 7 CVEs	before 0:5.0.30-0jpp_6rh	0:5.0.30-0jpp_6rh
`tyrex` Red Hat:network_satellite:4.2::el4 From an advisory covering 7 CVEs	before 0:1.0.1-2jpp_2rh	0:1.0.1-2jpp_2rh
`jakarta-commons-pool` Red Hat:network_satellite:5.0:el4 From an advisory covering 7 CVEs	before 0:1.2-2jpp_2rh	0:1.2-2jpp_2rh
`tomcat5` Red Hat:network_satellite:5.0:el4 From an advisory covering 7 CVEs	before 0:5.0.30-0jpp_6rh	0:5.0.30-0jpp_6rh
`tyrex` Red Hat:network_satellite:5.0:el4 From an advisory covering 7 CVEs	before 0:1.0.1-2jpp_2rh	0:1.0.1-2jpp_2rh
`tomcat5` Red Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs	before 0:5.5.23-0jpp_11rh	0:5.5.23-0jpp_11rh
`tomcat5-common-lib` Red Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs	before 0:5.5.23-0jpp_11rh	0:5.5.23-0jpp_11rh
`tomcat5-jasper` Red Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs	before 0:5.5.23-0jpp_11rh	0:5.5.23-0jpp_11rh
`tomcat5-jsp-2.0-api` Red Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs	before 0:5.5.23-0jpp_11rh	0:5.5.23-0jpp_11rh
`tomcat5-server-lib` Red Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs	before 0:5.5.23-0jpp_11rh	0:5.5.23-0jpp_11rh
`tomcat5-servlet-2.4-api` Red Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs	before 0:5.5.23-0jpp_11rh	0:5.5.23-0jpp_11rh
`jabberd` Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs	before 0:2.0s10-3.38.rhn	0:2.0s10-3.38.rhn
`java-1.4.2-ibm` Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs	before 0:1.4.2.10-1jpp.2.el4	0:1.4.2.10-1jpp.2.el4
`java-1.4.2-ibm-devel` Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs	before 0:1.4.2.10-1jpp.2.el4	0:1.4.2.10-1jpp.2.el4
`jfreechart` Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs	before 0:0.9.20-3.rhn	0:0.9.20-3.rhn
`openmotif21` Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs	before 0:2.1.30-11.RHEL4.6	0:2.1.30-11.RHEL4.6
`openmotif21-debuginfo` Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs	before 0:2.1.30-11.RHEL4.6	0:2.1.30-11.RHEL4.6
`perl-Crypt-CBC` Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs	before 0:2.24-1.el4	0:2.24-1.el4
`rhn-apache` Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs	before 0:1.3.27-36.rhn.rhel4	0:1.3.27-36.rhn.rhel4
`rhn-modjk-ap13` Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs	before 0:1.2.23-2rhn.rhel4	0:1.2.23-2rhn.rhel4
`rhn-modperl` Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs	before 0:1.29-16.rhel4	0:1.29-16.rhel4
`rhn-modssl` Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs	before 0:2.8.12-8.rhn.10.rhel4	0:2.8.12-8.rhn.10.rhel4
`tomcat5` Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs	before 0:5.0.30-0jpp_10rh	0:5.0.30-0jpp_10rh
`jabberd` Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs	before 0:2.0s10-3.37.rhn	0:2.0s10-3.37.rhn
`java-1.4.2-ibm` Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs	before 0:1.4.2.10-1jpp.2.el3	0:1.4.2.10-1jpp.2.el3
`java-1.4.2-ibm-devel` Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs	before 0:1.4.2.10-1jpp.2.el3	0:1.4.2.10-1jpp.2.el3
`jfreechart` Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs	before 0:0.9.20-3.rhn	0:0.9.20-3.rhn
`openmotif21` Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs	before 0:2.1.30-9.RHEL3.8	0:2.1.30-9.RHEL3.8
`openmotif21-debuginfo` Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs	before 0:2.1.30-9.RHEL3.8	0:2.1.30-9.RHEL3.8
`perl-Crypt-CBC` Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs	before 0:2.24-1.el3	0:2.24-1.el3
`rhn-apache` Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs	before 0:1.3.27-36.rhn.rhel3	0:1.3.27-36.rhn.rhel3
`rhn-modjk-ap13` Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs	before 0:1.2.23-2rhn.rhel3	0:1.2.23-2rhn.rhel3
`rhn-modperl` Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs	before 0:1.29-16.rhel3	0:1.29-16.rhel3
`rhn-modssl` Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs	before 0:2.8.12-8.rhn.10.rhel3	0:2.8.12-8.rhn.10.rhel3
`tomcat5` Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs	before 0:5.0.30-0jpp_10rh	0:5.0.30-0jpp_10rh
`jabberd` Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs	before 0:2.0s10-3.38.rhn	0:2.0s10-3.38.rhn
`java-1.4.2-ibm` Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs	before 0:1.4.2.10-1jpp.2.el4	0:1.4.2.10-1jpp.2.el4
`java-1.4.2-ibm-devel` Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs	before 0:1.4.2.10-1jpp.2.el4	0:1.4.2.10-1jpp.2.el4
`jfreechart` Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs	before 0:0.9.20-3.rhn	0:0.9.20-3.rhn
`openmotif21` Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs	before 0:2.1.30-11.RHEL4.6	0:2.1.30-11.RHEL4.6
`openmotif21-debuginfo` Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs	before 0:2.1.30-11.RHEL4.6	0:2.1.30-11.RHEL4.6
`perl-Crypt-CBC` Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs	before 0:2.24-1.el4	0:2.24-1.el4
`rhn-apache` Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs	before 0:1.3.27-36.rhn.rhel4	0:1.3.27-36.rhn.rhel4
`rhn-modjk-ap13` Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs	before 0:1.2.23-2rhn.rhel4	0:1.2.23-2rhn.rhel4
`rhn-modperl` Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs	before 0:1.29-16.rhel4	0:1.29-16.rhel4
`rhn-modssl` Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs	before 0:2.8.12-8.rhn.10.rhel4	0:2.8.12-8.rhn.10.rhel4
`tomcat5` Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs	before 0:5.0.30-0jpp_10rh	0:5.0.30-0jpp_10rh
`ant` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.6.5-1jpp_1rh	0:1.6.5-1jpp_1rh
`avalon-logkit` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.2-2jpp_4rh	0:1.2-2jpp_4rh
`axis` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.2.1-1jpp_3rh	0:1.2.1-1jpp_3rh
`classpathx-jaf` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.0-2jpp_6rh	0:1.0-2jpp_6rh
`classpathx-mail` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.1.1-2jpp_8rh	0:1.1.1-2jpp_8rh
`geronimo-ejb-2.1-api` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.0-0.M4.1jpp_10rh	0:1.0-0.M4.1jpp_10rh
`geronimo-j2ee-1.4-apis` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.0-0.M4.1jpp_10rh	0:1.0-0.M4.1jpp_10rh
`geronimo-j2ee-connector-1.5-api` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.0-0.M4.1jpp_10rh	0:1.0-0.M4.1jpp_10rh
`geronimo-j2ee-deployment-1.1-api` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.0-0.M4.1jpp_10rh	0:1.0-0.M4.1jpp_10rh
`geronimo-j2ee-management-1.0-api` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.0-0.M4.1jpp_10rh	0:1.0-0.M4.1jpp_10rh
`geronimo-jms-1.1-api` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.0-0.M4.1jpp_10rh	0:1.0-0.M4.1jpp_10rh
`geronimo-jsp-2.0-api` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.0-0.M4.1jpp_10rh	0:1.0-0.M4.1jpp_10rh
`geronimo-jta-1.0.1B-api` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.0-0.M4.1jpp_10rh	0:1.0-0.M4.1jpp_10rh
`geronimo-servlet-2.4-api` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.0-0.M4.1jpp_10rh	0:1.0-0.M4.1jpp_10rh
`geronimo-specs` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.0-0.M4.1jpp_10rh	0:1.0-0.M4.1jpp_10rh
`geronimo-specs-javadoc` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.0-0.M4.1jpp_10rh	0:1.0-0.M4.1jpp_10rh
`jakarta-commons-modeler` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:2.0-3jpp_2rh	0:2.0-3jpp_2rh
`log4j` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.2.12-1jpp_1rh	0:1.2.12-1jpp_1rh
`mx4j` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 1:3.0.1-1jpp_4rh	1:3.0.1-1jpp_4rh
`pcsc-lite` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.3.3-3.el4	0:1.3.3-3.el4
`pcsc-lite-debuginfo` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.3.3-3.el4	0:1.3.3-3.el4
`pcsc-lite-doc` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.3.3-3.el4	0:1.3.3-3.el4
`pcsc-lite-libs` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.3.3-3.el4	0:1.3.3-3.el4
`rhpki-ca` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:7.3.0-20.el4	0:7.3.0-20.el4
`rhpki-java-tools` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:7.3.0-10.el4	0:7.3.0-10.el4
`rhpki-kra` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:7.3.0-14.el4	0:7.3.0-14.el4
`rhpki-manage` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:7.3.0-19.el4	0:7.3.0-19.el4
`rhpki-native-tools` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:7.3.0-6.el4	0:7.3.0-6.el4
`rhpki-ocsp` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:7.3.0-13.el4	0:7.3.0-13.el4
`rhpki-tks` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:7.3.0-13.el4	0:7.3.0-13.el4
`tomcat5` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:5.5.23-0jpp_4rh.16	0:5.5.23-0jpp_4rh.16
`tomcat5-common-lib` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:5.5.23-0jpp_4rh.16	0:5.5.23-0jpp_4rh.16
`tomcat5-jasper` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:5.5.23-0jpp_4rh.16	0:5.5.23-0jpp_4rh.16
`tomcat5-jsp-2.0-api` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:5.5.23-0jpp_4rh.16	0:5.5.23-0jpp_4rh.16
`tomcat5-server-lib` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:5.5.23-0jpp_4rh.16	0:5.5.23-0jpp_4rh.16
`tomcat5-servlet-2.4-api` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:5.5.23-0jpp_4rh.16	0:5.5.23-0jpp_4rh.16
`xerces-j2` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:2.7.1-1jpp_1rh	0:2.7.1-1jpp_1rh
`xml-commons` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.3.02-2jpp_1rh	0:1.3.02-2jpp_1rh
`xml-commons-apis` Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs	before 0:1.3.02-2jpp_1rh	0:1.3.02-2jpp_1rh

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	affected, aliases, facts, references, title	GitHub Advisories, OSV
Nov 2, 2026	first indexed	CVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-3385 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published August 14, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 16.9%, the 97th percentile. No source names a fixed version.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 142 references. The JSON record has them.