Description

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.

Remediation

References

CVE-2007-5333

Related Vulnerabilities

WordPress Plugin WP Mobile Edition Arbitrary File Disclosure (2.2.7)

Chamilo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-37065)

PHP Use of Insufficiently Random Values Vulnerability (CVE-2023-3247)

IBM WebSEAL Incorrect Default Permissions Vulnerability (CVE-2024-35139)

Django Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2025-27556)

Severity

Medium

Classification

CVE-2007-5333 CWE-200

Tags

Missing Update Known Vulnerabilities