Servers and applications
CVE-2007-3385 Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.
Severity Medium 4.3
Published 14 Aug 2007
Last changed 16 Jun 2026
Added to UpHeron 21 Oct 2026 Exploit chance 17% in the next 30 daysHigher than 97% of CVEs. EPSS by FIRST , 12 Nov 2026
Attack Over the network · No login needed
Attacker can Read some data
CVSS vector AV:N/AC:M/Au:N/C:P/I:N/A:N
Sources NVD Affected software Software Affected versions Apache TomcatServers and applications · cpe:a:apache:tomcat Version 6.0.13 Version 6.0.12 Version 6.0.11 Version 6.0.10 All 85 release lines Version 3.3 Version 3.3.1 Version 3.3.1a Version 3.3.2 Version 4.1.0 Version 4.1.1 Version 4.1.2 Version 4.1.3-beta Version 4.1.3 Version 4.1.9-beta Version 4.1.10 Version 4.1.15 Version 4.1.24 Version 4.1.28 Version 4.1.31 Version 4.1.36 Version 5.0.0 Version 5.0.1 Version 5.0.2 Version 5.0.3 Version 5.0.4 Version 5.0.5 Version 5.0.6 Version 5.0.7 Version 5.0.8 Version 5.0.9 Version 5.0.10 Version 5.0.11 Version 5.0.12 Version 5.0.13 Version 5.0.14 Version 5.0.15 Version 5.0.16 Version 5.0.17 Version 5.0.18 Version 5.0.19 Version 5.0.21 Version 5.0.22 Version 5.0.23 Version 5.0.24 Version 5.0.25 Version 5.0.26 Version 5.0.27 Version 5.0.28 Version 5.0.29 Version 5.0.30 Version 5.5.0 Version 5.5.1 Version 5.5.2 Version 5.5.3 Version 5.5.4 Version 5.5.5 Version 5.5.6 Version 5.5.7 Version 5.5.8 Version 5.5.9 Version 5.5.10 Version 5.5.11 Version 5.5.12 Version 5.5.13 Version 5.5.14 Version 5.5.15 Version 5.5.16 Version 5.5.17 Version 5.5.18 Version 5.5.19 Version 5.5.20 Version 5.5.21 Version 5.5.22 Version 5.5.23 Version 5.5.24 Version 6.0.0 Version 6.0.1 Version 6.0.2 Version 6.0.3 Version 6.0.4 Version 6.0.5 Version 6.0.6 Version 6.0.7 Version 6.0.8 Version 6.0.9 Version 6.0.10 Version 6.0.11 Version 6.0.12 Version 6.0.13
References NVD https://nvd.nist.gov/vuln/detail/CVE-2007-3385 CVE.org https://www.cve.org/CVERecord?id=CVE-2007-3385