Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does…
Priority MEDIUM 58CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.
Why it matters now
EPSS 0.62575 99th percentileScored 2026-11-07
Fix Fixed org.apache.tomcat:tomcat (Maven): 6.0.15, 5.5.26, 4.1.37Red Hat: 6 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 6.0.0 to before 6.0.15 | 6.0.15 | Patch available | GHSA-cww4-vj5r-rx57 |
| — | org.apache.tomcat:tomcat (Maven) | 5.5.0 to before 5.5.26 | 5.5.26 | Patch available | GHSA-cww4-vj5r-rx57 |
| — | org.apache.tomcat:tomcat (Maven) | 4.1.0 to before 4.1.37 | 4.1.37 | Patch available | GHSA-cww4-vj5r-rx57 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 6.0.0 to before 6.0.15 Fixed in 6.0.15 Patch available GHSA-cww4-vj5r-rx57
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 5.5.0 to before 5.5.26 Fixed in 5.5.26 Patch available GHSA-cww4-vj5r-rx57
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 4.1.0 to before 4.1.37 Fixed in 4.1.37 Patch available GHSA-cww4-vj5r-rx57
Remediation
- Fix · GHSA-cww4-vj5r-rx57 org.apache.tomcat:tomcat (Maven) Fixed in 6.0.15 Advisory →
- Fix · GHSA-cww4-vj5r-rx57 org.apache.tomcat:tomcat (Maven) Fixed in 5.5.26 Advisory →
- Fix · GHSA-cww4-vj5r-rx57 org.apache.tomcat:tomcat (Maven) Fixed in 4.1.37 Advisory →
Red Hat 6 advisories
- RHSA-2010:0602 Released 2010-08-04 · Red Hat rating ModerateRed Hat Certificate System 7.3 security update
- Red Hat Certificate System 7.3 for 4AS ant-1.6.5-1jpp_1rh, avalon-logkit-1.2-2jpp_4rh, axis-1.2.1-1jpp_3rh +39
- Red Hat Certificate System 7.3 for 4ES ant-1.6.5-1jpp_1rh, avalon-logkit-1.2-2jpp_4rh, axis-1.2.1-1jpp_3rh +39
- RHSA-2009:1616 Released 2009-11-30 · Red Hat rating Lowtomcat security update for Red Hat Network Satellite Server
- Red Hat Satellite 5.2 (RHEL v.4 AS) tomcat5-5.5.23-0jpp_18rh, tomcat5-common-lib-5.5.23-0jpp_18rh, tomcat5-jasper-5.5.23-0jpp_18rh +3
- Red Hat Satellite 5.3 (RHEL v.4) tomcat5-5.5.23-0jpp_18rh, tomcat5-common-lib-5.5.23-0jpp_18rh, tomcat5-jasper-5.5.23-0jpp_18rh +3
- RHSA-2009:1563 Released 2009-11-09 · Red Hat rating Importanttomcat security update
- Red Hat Developer Suite v.3 (AS v.4) tomcat5-5.5.23-0jpp_18rh, tomcat5-common-lib-5.5.23-0jpp_18rh, tomcat5-jasper-5.5.23-0jpp_18rh +3
Show 3 more Red Hat advisories
- RHSA-2009:1562 Released 2009-11-09 · Red Hat rating Importanttomcat security update
- Red Hat Application Server v2 4AS tomcat5-5.5.23-0jpp_4rh.16, tomcat5-admin-webapps-5.5.23-0jpp_4rh.16, tomcat5-common-lib-5.5.23-0jpp_4rh.16 +8
- Red Hat Application Server v2 4ES tomcat5-5.5.23-0jpp_4rh.16, tomcat5-admin-webapps-5.5.23-0jpp_4rh.16, tomcat5-common-lib-5.5.23-0jpp_4rh.16 +8
- Red Hat Application Server v2 4WS tomcat5-5.5.23-0jpp_4rh.16, tomcat5-admin-webapps-5.5.23-0jpp_4rh.16, tomcat5-common-lib-5.5.23-0jpp_4rh.16 +8
- RHSA-2009:1454 Released 2009-09-21 · Red Hat rating Importanttomcat5 security update
- Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server tomcat5-5.5.23-0jpp.9.6.ep5.el5, tomcat5-admin-webapps-5.5.23-0jpp.9.6.ep5.el5, tomcat5-common-lib-5.5.23-0jpp.9.6.ep5.el5 +8
- Red Hat JBoss Web Server 1.0 for RHEL 4 AS tomcat5-5.5.23-1.patch07.19.ep5.el4, tomcat5-admin-webapps-5.5.23-1.patch07.19.ep5.el4, tomcat5-common-lib-5.5.23-1.patch07.19.ep5.el4 +8
- Red Hat JBoss Web Server 1.0 for RHEL 4 ES tomcat5-5.5.23-1.patch07.19.ep5.el4, tomcat5-admin-webapps-5.5.23-1.patch07.19.ep5.el4, tomcat5-common-lib-5.5.23-1.patch07.19.ep5.el4 +8
- RHSA-2009:1164 Released 2009-07-21 · Red Hat rating Importanttomcat security update
- Red Hat Enterprise Linux (v. 5 server) tomcat5-5.5.23-0jpp.7.el5_3.2, tomcat5-5.5.23-0jpp.7.el5_3.2.i386, tomcat5-5.5.23-0jpp.7.el5_3.2.ia64 +41
- Red Hat Enterprise Linux Desktop (v. 5 client) tomcat5-5.5.23-0jpp.7.el5_3.2, tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2, tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.i386 +2
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) tomcat5-5.5.23-0jpp.7.el5_3.2, tomcat5-5.5.23-0jpp.7.el5_3.2.i386, tomcat5-admin-webapps-5.5.23-0jpp.7.el5_3.2 +15
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Application Server v2 4AS | Fixed | RHSA-2009:1562 |
| Red Hat Application Server v2 4ES | Fixed | RHSA-2009:1562 |
| Red Hat Application Server v2 4WS | Fixed | RHSA-2009:1562 |
| Red Hat Certificate System 7.3 for 4AS | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 for 4ES | Fixed | RHSA-2010:0602 |
| Red Hat Developer Suite v.3 (AS v.4) | Fixed | RHSA-2009:1563 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2009:1164 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2009:1164 |
| Red Hat Enterprise Linux Desktop Workstation (v. 5 client) | Fixed | RHSA-2009:1164 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server | Fixed | RHSA-2009:1454 |
| Red Hat JBoss Web Server 1.0 for RHEL 4 AS | Fixed | RHSA-2009:1454 |
| Red Hat JBoss Web Server 1.0 for RHEL 4 ES | Fixed | RHSA-2009:1454 |
| Red Hat Satellite 5.2 (RHEL v.4 AS) | Fixed | RHSA-2009:1616 |
| Red Hat Satellite 5.3 (RHEL v.4) | Fixed | RHSA-2009:1616 |
Timeline
- 2026-10-02 Threatist record created from CVE-2007-5333
- 2026-10-03 Alias added: GHSA-cww4-vj5r-rx57
References
Advisory 26
- http://tomcat.apache.org/security-4.html
- http://support.apple.com/kb/HT2163
- 3636
- JVN#09470767
- IZ20133
- IZ20991
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- http://www-01.ibm.com/support/docview.wss?uid=swg27012048
- APPLE-SA-2008-06-30
- MDVSA-2010:176
- SUSE-SR:2009:004
- MDVSA-2009:018
- http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp08/html-single/Release_Notes/index.html
- http://tomcat.apache.org/security-6.html
- http://www-01.ibm.com/support/docview.wss?uid=swg27012047
- FEDORA-2008-1467
- GLSA-200804-10
- FEDORA-2008-1603
- http://www.vmware.com/security/advisories/VMSA-2008-0010.html
- http://tomcat.apache.org/security-5.html
- HPSBST02955
- APPLE-SA-2008-10-09
- http://support.apple.com/kb/HT3216
- http://www-01.ibm.com/support/docview.wss?uid=swg24018932
- https://bugzilla.redhat.com/show_bug.cgi?id=532111
- https://nvd.nist.gov/vuln/detail/CVE-2007-5333
Other 22
- ADV-2008-2690
- ADV-2008-1981
- oval:org.mitre.oval:def:11177
- ADV-2008-0488
- ADV-2008-1856
- ADV-2008-2780
- ADV-2009-3316
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/
- https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E
- https://github.com/apache/tomcat
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2007-5333 · CVE Program
- CVE-2007-5333 · NVD
- FIRST EPSS
- GHSA-cww4-vj5r-rx57 · GitHub Advisory Database · CC BY 4.0
- CVE-2007-5333 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences