Information disclosure in Apache Tomcat
CVE-2007-5333
Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information…
Vulnerability class: Information Disclosure
EPSS: 0.626 (99.1th percentile) — read the EPSS interpretation.
Affected products
- Apache Tomcat
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (URL Repurposed, vdb-entry, x_refsource_VUPEN)
- secalert@redhat.com (x_refsource_SECUNIA, Broken Link, third-party-advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory)
- secalert@redhat.com (x_refsource_SECUNIA, Broken Link, third-party-advisory)
- secalert@redhat.com (Exploit, Patch, VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- secalert@redhat.com (x_refsource_SREASON, Broken Link, third-party-advisory)
- secalert@redhat.com (VDB Entry, Third Party Advisory, x_refsource_JVN, third-party-advisory)
- secalert@redhat.com (URL Repurposed, vdb-entry, x_refsource_VUPEN)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_AIXAPAR)