PT-2007-4660 · Apache+2 · Apache Tomcat+2
Publicado
2007-08-14
·
Atualizado
2022-05-01
·
CVE-2007-3385
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Tomcat versions 3.3 to 3.3.2
Apache Tomcat versions 4.1.0 to 4.1.36
Apache Tomcat versions 5.0.0 to 5.0.30
Apache Tomcat versions 5.5.0 to 5.5.24
Apache Tomcat versions 6.0.0 to 6.0.13
Description
The issue arises from improper handling of the `` character sequence in a cookie value, potentially leading to the leakage of sensitive information such as session IDs to remote attackers. This could enable session hijacking attacks.
Recommendations
For Apache Tomcat versions 3.3 to 3.3.2, update to a version that properly handles the
character sequence in cookie values. For Apache Tomcat versions 4.1.0 to 4.1.36, update to a version that properly handles the character sequence in cookie values.
For Apache Tomcat versions 5.0.0 to 5.0.30, update to a version that properly handles the character sequence in cookie values. For Apache Tomcat versions 5.5.0 to 5.5.24, update to a version that properly handles the character sequence in cookie values.
For Apache Tomcat versions 6.0.0 to 6.0.13, update to a version that properly handles the `` character sequence in cookie values.Exploit
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Tomcat
Hp-Ux
Red Hat