CVE-2007-3382
Apache Tomcat treats single quotes as delimiters in cookies
4.3 MediumPublic exploit
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
Exploit likelihood
37.5%Down 0.7 points since Feb 4, 2022
What each source reports
NVD Score used
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
- Record
CVE-2007-3382- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
- Record
CVE-2007-3382- Updated
- 2026-11-02
EUVDEUVD-2022-4959 No score
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
- Record
EUVD-2022-4959- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qff8-g48j-pwpw No score
Apache Tomcat treats single quotes as delimiters in cookies
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes (') as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
- Record
GHSA-qff8-g48j-pwpw- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-qff8-g48j-pwpw No score
Apache Tomcat treats single quotes as delimiters in cookies
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes (') as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
- Record
GHSA-qff8-g48j-pwpw- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
6.0.0 to 6.0.13 | None known |
org.apache.tomcat:tomcatMaven |
5.5.0 to 5.5.24 | None known |
org.apache.tomcat:tomcatMaven |
5.0.0 to 5.0.30 | None known |
org.apache.tomcat:tomcatMaven |
4.1.0 to 4.1.36 | None known |
org.apache.tomcat:tomcatMaven |
3.3.0 to 3.3.2 | None known |
tomcat5.5Debian:4.0 From an advisory covering 5 CVEs |
before 5.5.20-2etch1, plus listed versions 5.5.20-2 |
5.5.20-2etch1 |
tomcat5Debian:4.0 From an advisory covering 3 CVEs |
before 5.0.30-12etch1, plus listed versions 5.0.30-12 |
5.0.30-12etch1 |
tomcat5Red Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-common-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
Show 156 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat5-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-jasperRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-server-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-webappsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5Red Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5Red Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-common-libRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-jasperRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-server-libRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-webappsRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5Red Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-admin-webappsRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-common-libRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-jasperRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-jasper-javadocRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-jsp-2.0-apiRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-jsp-2.0-api-javadocRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-server-libRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-servlet-2.4-apiRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-servlet-2.4-api-javadocRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-webappsRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
berkeleydbRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:2.0.90-1jpp.ep1.1 | 0:2.0.90-1jpp.ep1.1 |
hibernate3-annotationsRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:3.2.1-1.patch01.1jpp.ep1.2 | 0:3.2.1-1.patch01.1jpp.ep1.2 |
hibernate3-annotations-javadocRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:3.2.1-1.patch01.1jpp.ep1.2 | 0:3.2.1-1.patch01.1jpp.ep1.2 |
hibernate3-ejb-persistence-3.0-apiRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:3.2.1-1jpp.ep1.1 | 0:3.2.1-1jpp.ep1.1 |
hibernate3-ejb-persistence-3.0-api-javadocRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:3.2.1-1jpp.ep1.1 | 0:3.2.1-1jpp.ep1.1 |
hibernate3-entitymanagerRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:3.2.1-1jpp.ep1.5 | 0:3.2.1-1jpp.ep1.5 |
hibernate3-entitymanager-javadocRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:3.2.1-1jpp.ep1.5 | 0:3.2.1-1jpp.ep1.5 |
jacorbRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:2.3.0-1jpp.ep1.1 | 0:2.3.0-1jpp.ep1.1 |
jboss-aopRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:1.5.5-0jpp.ep1.2.1 | 0:1.5.5-0jpp.ep1.2.1 |
jboss-cacheRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:1.4.1-1.SP3.1jpp.ep1.1 | 0:1.4.1-1.SP3.1jpp.ep1.1 |
jboss-remotingRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:2.2.2-1jpp.ep1.4 | 0:2.2.2-1jpp.ep1.4 |
jboss-seamRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:1.2.1-1.ep1.2 | 0:1.2.1-1.ep1.2 |
jboss-seam-docsRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:1.2.1-1.ep1.2 | 0:1.2.1-1.ep1.2 |
jboss-serializationRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:1.0.3-1jpp.ep1.3 | 0:1.0.3-1jpp.ep1.3 |
jbossasRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:4.2.0-2.CP01.ep1.4 | 0:4.2.0-2.CP01.ep1.4 |
jbosswebRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:2.0.0-2.CP01.0jpp.ep1.4 | 0:2.0.0-2.CP01.0jpp.ep1.4 |
jbossxbRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:1.0.0-1.CP01.0jpp.ep1.1 | 0:1.0.0-1.CP01.0jpp.ep1.1 |
jcommonRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:0.9.7-1jpp.el4ep1.1 | 0:0.9.7-1jpp.el4ep1.1 |
jfreechartRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:0.9.21-2jpp.el4ep1.1 | 0:0.9.21-2jpp.el4ep1.1 |
rh-eap-docsRed Hat:rhel_application_stack:1 From an advisory covering 2 CVEs |
before 0:4.2.0-2.CP01.ep1.2 | 0:4.2.0-2.CP01.ep1.2 |
jakarta-commons-poolRed Hat:network_satellite:4.0::el3 From an advisory covering 7 CVEs |
before 0:1.2-2jpp_2rh | 0:1.2-2jpp_2rh |
tomcat5Red Hat:network_satellite:4.0::el3 From an advisory covering 7 CVEs |
before 0:5.0.30-0jpp_6rh | 0:5.0.30-0jpp_6rh |
tyrexRed Hat:network_satellite:4.0::el3 From an advisory covering 7 CVEs |
before 0:1.0.1-2jpp_2rh | 0:1.0.1-2jpp_2rh |
jakarta-commons-poolRed Hat:network_satellite:4.1::el3 From an advisory covering 7 CVEs |
before 0:1.2-2jpp_2rh | 0:1.2-2jpp_2rh |
tomcat5Red Hat:network_satellite:4.1::el3 From an advisory covering 7 CVEs |
before 0:5.0.30-0jpp_6rh | 0:5.0.30-0jpp_6rh |
tyrexRed Hat:network_satellite:4.1::el3 From an advisory covering 7 CVEs |
before 0:1.0.1-2jpp_2rh | 0:1.0.1-2jpp_2rh |
jakarta-commons-poolRed Hat:network_satellite:4.2::el3 From an advisory covering 7 CVEs |
before 0:1.2-2jpp_2rh | 0:1.2-2jpp_2rh |
tomcat5Red Hat:network_satellite:4.2::el3 From an advisory covering 7 CVEs |
before 0:5.0.30-0jpp_6rh | 0:5.0.30-0jpp_6rh |
tyrexRed Hat:network_satellite:4.2::el3 From an advisory covering 7 CVEs |
before 0:1.0.1-2jpp_2rh | 0:1.0.1-2jpp_2rh |
jakarta-commons-poolRed Hat:network_satellite:4.0::el4 From an advisory covering 7 CVEs |
before 0:1.2-2jpp_2rh | 0:1.2-2jpp_2rh |
tomcat5Red Hat:network_satellite:4.0::el4 From an advisory covering 7 CVEs |
before 0:5.0.30-0jpp_6rh | 0:5.0.30-0jpp_6rh |
tyrexRed Hat:network_satellite:4.0::el4 From an advisory covering 7 CVEs |
before 0:1.0.1-2jpp_2rh | 0:1.0.1-2jpp_2rh |
jakarta-commons-poolRed Hat:network_satellite:4.1::el4 From an advisory covering 7 CVEs |
before 0:1.2-2jpp_2rh | 0:1.2-2jpp_2rh |
tomcat5Red Hat:network_satellite:4.1::el4 From an advisory covering 7 CVEs |
before 0:5.0.30-0jpp_6rh | 0:5.0.30-0jpp_6rh |
tyrexRed Hat:network_satellite:4.1::el4 From an advisory covering 7 CVEs |
before 0:1.0.1-2jpp_2rh | 0:1.0.1-2jpp_2rh |
jakarta-commons-poolRed Hat:network_satellite:4.2::el4 From an advisory covering 7 CVEs |
before 0:1.2-2jpp_2rh | 0:1.2-2jpp_2rh |
tomcat5Red Hat:network_satellite:4.2::el4 From an advisory covering 7 CVEs |
before 0:5.0.30-0jpp_6rh | 0:5.0.30-0jpp_6rh |
tyrexRed Hat:network_satellite:4.2::el4 From an advisory covering 7 CVEs |
before 0:1.0.1-2jpp_2rh | 0:1.0.1-2jpp_2rh |
jakarta-commons-poolRed Hat:network_satellite:5.0:el4 From an advisory covering 7 CVEs |
before 0:1.2-2jpp_2rh | 0:1.2-2jpp_2rh |
tomcat5Red Hat:network_satellite:5.0:el4 From an advisory covering 7 CVEs |
before 0:5.0.30-0jpp_6rh | 0:5.0.30-0jpp_6rh |
tyrexRed Hat:network_satellite:5.0:el4 From an advisory covering 7 CVEs |
before 0:1.0.1-2jpp_2rh | 0:1.0.1-2jpp_2rh |
tomcat5Red Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_11rh | 0:5.5.23-0jpp_11rh |
tomcat5-common-libRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_11rh | 0:5.5.23-0jpp_11rh |
tomcat5-jasperRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_11rh | 0:5.5.23-0jpp_11rh |
tomcat5-jsp-2.0-apiRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_11rh | 0:5.5.23-0jpp_11rh |
tomcat5-server-libRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_11rh | 0:5.5.23-0jpp_11rh |
tomcat5-servlet-2.4-apiRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_11rh | 0:5.5.23-0jpp_11rh |
jabberdRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.0s10-3.38.rhn | 0:2.0s10-3.38.rhn |
java-1.4.2-ibmRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
java-1.4.2-ibm-develRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
jfreechartRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
openmotif21-debuginfoRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
perl-Crypt-CBCRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.24-1.el4 | 0:2.24-1.el4 |
rhn-apacheRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.3.27-36.rhn.rhel4 | 0:1.3.27-36.rhn.rhel4 |
rhn-modjk-ap13Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.2.23-2rhn.rhel4 | 0:1.2.23-2rhn.rhel4 |
rhn-modperlRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.29-16.rhel4 | 0:1.29-16.rhel4 |
rhn-modsslRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.8.12-8.rhn.10.rhel4 | 0:2.8.12-8.rhn.10.rhel4 |
tomcat5Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
jabberdRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.0s10-3.37.rhn | 0:2.0s10-3.37.rhn |
java-1.4.2-ibmRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el3 | 0:1.4.2.10-1jpp.2.el3 |
java-1.4.2-ibm-develRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el3 | 0:1.4.2.10-1jpp.2.el3 |
jfreechartRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.1.30-9.RHEL3.8 | 0:2.1.30-9.RHEL3.8 |
openmotif21-debuginfoRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.1.30-9.RHEL3.8 | 0:2.1.30-9.RHEL3.8 |
perl-Crypt-CBCRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.24-1.el3 | 0:2.24-1.el3 |
rhn-apacheRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.3.27-36.rhn.rhel3 | 0:1.3.27-36.rhn.rhel3 |
rhn-modjk-ap13Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.2.23-2rhn.rhel3 | 0:1.2.23-2rhn.rhel3 |
rhn-modperlRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.29-16.rhel3 | 0:1.29-16.rhel3 |
rhn-modsslRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.8.12-8.rhn.10.rhel3 | 0:2.8.12-8.rhn.10.rhel3 |
tomcat5Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
jabberdRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.0s10-3.38.rhn | 0:2.0s10-3.38.rhn |
java-1.4.2-ibmRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
java-1.4.2-ibm-develRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
jfreechartRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
openmotif21-debuginfoRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
perl-Crypt-CBCRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.24-1.el4 | 0:2.24-1.el4 |
rhn-apacheRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.3.27-36.rhn.rhel4 | 0:1.3.27-36.rhn.rhel4 |
rhn-modjk-ap13Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.2.23-2rhn.rhel4 | 0:1.2.23-2rhn.rhel4 |
rhn-modperlRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.29-16.rhel4 | 0:1.29-16.rhel4 |
rhn-modsslRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.8.12-8.rhn.10.rhel4 | 0:2.8.12-8.rhn.10.rhel4 |
tomcat5Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
antRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.6.5-1jpp_1rh | 0:1.6.5-1jpp_1rh |
avalon-logkitRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.2-2jpp_4rh | 0:1.2-2jpp_4rh |
axisRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.2.1-1jpp_3rh | 0:1.2.1-1jpp_3rh |
classpathx-jafRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-2jpp_6rh | 0:1.0-2jpp_6rh |
classpathx-mailRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.1.1-2jpp_8rh | 0:1.1.1-2jpp_8rh |
geronimo-ejb-2.1-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-1.4-apisRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-connector-1.5-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-deployment-1.1-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-j2ee-management-1.0-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-jms-1.1-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-jsp-2.0-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-jta-1.0.1B-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-servlet-2.4-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-specsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
geronimo-specs-javadocRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.0-0.M4.1jpp_10rh | 0:1.0-0.M4.1jpp_10rh |
jakarta-commons-modelerRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:2.0-3jpp_2rh | 0:2.0-3jpp_2rh |
log4jRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.2.12-1jpp_1rh | 0:1.2.12-1jpp_1rh |
mx4jRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 1:3.0.1-1jpp_4rh | 1:3.0.1-1jpp_4rh |
pcsc-liteRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
pcsc-lite-debuginfoRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
pcsc-lite-docRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
pcsc-lite-libsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.3.3-3.el4 | 0:1.3.3-3.el4 |
rhpki-caRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:7.3.0-20.el4 | 0:7.3.0-20.el4 |
rhpki-java-toolsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:7.3.0-10.el4 | 0:7.3.0-10.el4 |
rhpki-kraRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:7.3.0-14.el4 | 0:7.3.0-14.el4 |
rhpki-manageRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:7.3.0-19.el4 | 0:7.3.0-19.el4 |
rhpki-native-toolsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:7.3.0-6.el4 | 0:7.3.0-6.el4 |
rhpki-ocspRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:7.3.0-13.el4 | 0:7.3.0-13.el4 |
rhpki-tksRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:7.3.0-13.el4 | 0:7.3.0-13.el4 |
tomcat5Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-common-libRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-jasperRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-jsp-2.0-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-server-libRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
tomcat5-servlet-2.4-apiRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:5.5.23-0jpp_4rh.16 | 0:5.5.23-0jpp_4rh.16 |
xerces-j2Red Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:2.7.1-1jpp_1rh | 0:2.7.1-1jpp_1rh |
xml-commonsRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.3.02-2jpp_1rh | 0:1.3.02-2jpp_1rh |
xml-commons-apisRed Hat:certificate_system:7.3 From an advisory covering 39 CVEs |
before 0:1.3.02-2jpp_1rh | 0:1.3.02-2jpp_1rh |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Tomcat 6.0.13 - Insecure Cookie Handling Quote Delimiter Session ID Disclosure | 2007-08-14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| affected, aliases, exploits, facts, references, title | Exploit-DB, GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-3382 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published August 14, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 37.5%, the 98th percentile. No source names a fixed version.
References
debian.org/security/2008/dsa-1453
redhat.com/support/errata/RHSA-2007-0950.html
support.apple.com/kb/HT2163
securityfocus.com/archive/1/476466/100/0/threaded
vupen.com/english/advisories/2008/1981/references
Show 194 moreShow less
secunia.com/advisories/27267
securitytracker.com/id?1018556
lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
www-01.ibm.com/support/docview.wss?uid=swg1IZ55562
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554
lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
tomcat.apache.org/security-6.html
kb.cert.org/vuls/id/993544
community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11269
support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
exchange.xforce.ibmcloud.com/vulnerabilities/36006
mandriva.com/security/advisories?name=MDKSA-2007:241
lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2007-3382
github.com/advisories/GHSA-qff8-g48j-pwpw
access.redhat.com/errata/RHSA-2007:0871
bugzilla.redhat.com/show_bug.cgi?id=247972
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0871.json
cve.org/CVERecord?id=CVE-2007-3382
rhstack.108.redhat.com/docs/Red_Hat_Application_Stack_V.1.2_Release_Notes.html
This page doesn't list everything
Left out here: 133 references. The JSON record has them.