vulnwire
4.3med

CVE-2007-33821 exploit

Apache Tomcat treats single quotes as delimiters in cookies

Also known as GHSA-qff8-g48j-pwpw

Published 19 y ago · modified 4 mo ago · JSON

CVSS
4.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
37.5%
percentile 99%
Public exploits
1
Exploit-DB

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.

Exploit prediction (EPSS)

37.50% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

Exploits and detections

  • EDB-30496 Apache Tomcat 6.0.13 - Insecure Cookie Handling Quote Delimiter Session ID Disclosure · remote · 2007-08-14

CVSS scores

Assigned byVersionScoreVector
NVD2.04.3AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.tomcat:tomcat
>=6.0.0, <=6.0.13
>=5.5.0, <=5.5.24
>=5.0.0, <=5.0.30
>=4.1.0, <=4.1.36
>=3.3.0, <=3.3.2
no fix listed

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

  • debian.org /security/2008/dsa-1453 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • redhat.com /support/errata/RHSA-2007-0950.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • support.apple.com /kb/HT2163 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /archive/1/476466/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • vupen.com /english/advisories/2008/1981/references · vdb-entry, x_refsource_VUPEN, x_transferred
  • redhat.com /archives/fedora-package-announce/2007-November/msg00525.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • secunia.com /advisories/27267 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/29242 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2007/3527 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securitytracker.com /id?1018556 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • secunia.com /advisories/26466 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /archive/1/500412/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2008-03/msg00001.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • secunia.com /advisories/33668 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2007/2902 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securityfocus.com /archive/1/500396/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • secunia.com /advisories/26898 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/28361 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • www-01.ibm.com /support/docview.wss?uid=swg1IZ55562 · vendor-advisory, x_refsource_AIXAPAR, x_transferred
  • h20000.www2.hp.com /bizsupport/TechSupport/Document.jsp?objectID=c01192554 · vendor-advisory, x_refsource_HP, x_transferred
  • secunia.com /advisories/28317 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • lists.apple.com /archives/security-announce/2008//Jun/msg00002.html · vendor-advisory, x_refsource_APPLE, x_transferred
  • vupen.com /english/advisories/2009/0233 · vdb-entry, x_refsource_VUPEN, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2009-02/msg00002.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • tomcat.apache.org /security-6.html · x_refsource_CONFIRM, x_transferred
  • redhat.com /support/errata/RHSA-2007-0871.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • vupen.com /english/advisories/2007/3386 · vdb-entry, x_refsource_VUPEN, x_transferred
  • secunia.com /advisories/30802 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • redhat.com /support/errata/RHSA-2008-0195.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • secunia.com /advisories/27037 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /bid/25316 · vdb-entry, x_refsource_BID, x_transferred
  • kb.cert.org /vuls/id/993544 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • h20000.www2.hp.com /bizsupport/TechSupport/Document.jsp?objectID=c01178795 · vendor-advisory, x_refsource_HP, x_transferred
  • secunia.com /advisories/27727 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /archive/1/476442/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • redhat.com /support/errata/RHSA-2008-0261.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • secunia.com /advisories/36486 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • debian.org /security/2008/dsa-1447 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • community.ca.com /blogs/casecurityresponseblog/archive/2009/01/23.aspx · x_refsource_CONFIRM, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11269 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2007-3382 · advisory
  • exchange.xforce.ibmcloud.com /vulnerabilities/36006 · web
  • lists.apache.org /thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apach · web
  • support.ca.com /irj/portal/anonymous/phpsupcontent?contentID=197540
  • mandriva.com /security/advisories?name=MDKSA-2007:241

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.