GHSA-cww4-vj5r-rx57

Source

https://github.com/advisories/GHSA-cww4-vj5r-rx57

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-cww4-vj5r-rx57/GHSA-cww4-vj5r-rx57.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cww4-vj5r-rx57

Aliases

CVE-2007-5333

Published

2022-05-01T18:32:19Z

Modified

2025-04-09T15:23:22Z

Summary

Exposure of Sensitive Information in Apache Tomcat

Details

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.

Database specific

{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-200"
    ],
    "github_reviewed_at": "2023-02-14T00:59:09Z",
    "nvd_published_at": "2008-02-12T01:00:00Z",
    "severity": "MODERATE"
}

References

Affected packages

Maven / org.apache.tomcat:tomcat

Package

Name: org.apache.tomcat:tomcat; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.0.15

Maven / org.apache.tomcat:tomcat

Package

Name: org.apache.tomcat:tomcat; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.5.0

Fixed

5.5.26

Database specific

last_known_affected_version_range

"< 5.5.25"

Maven / org.apache.tomcat:tomcat

Package

Name: org.apache.tomcat:tomcat; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.1.0

Fixed

4.1.37

Database specific

last_known_affected_version_range

"< 4.1.36"