Vulnerability record · CVE-2007-5333 · published 12 February 2008
CVE-2007-5333: Apache Tomcat cookie parsing flaw leaks session IDs
Apache · Tomcat
Apache Tomcat versions 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 mishandle double quote characters and %5C encoded backslash sequences in cookie values. This incomplete fix for CVE-2007-3385 can cause sensitive data such as session IDs to be exposed, undermining session confidentiality.
Description
Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.
AV:N/AC:L/Au:N/C:P/I:N/A:N
Automated analysis
medium priorityCVSS 2.0 rates it medium with partial confidentiality impact, but the high EPSS percentile and session-hijacking potential warrant prompt patching.
What it is
Apache Tomcat versions 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 mishandle double quote characters and %5C encoded backslash sequences in cookie values. This incomplete fix for CVE-2007-3385 can cause sensitive data such as session IDs to be exposed, undermining session confidentiality.
Impact
An attacker who can observe or influence the affected cookie handling may obtain session IDs and use them to hijack authenticated sessions, gaining the victim's privileges.
Attack surface
The flaw is reachable over the network through HTTP cookie handling; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at 0.62575 (99th percentile), suggesting elevated likelihood of exploitation activity.
What to do
- Upgrade Tomcat to a release that includes the complete fix for CVE-2007-3385/CVE-2007-5333 (consult the vendor security pages for 4.x, 5.x and 6.x).
- If immediate upgrade is not possible, restrict or filter cookie values containing double quotes or %5C sequences at a reverse proxy or WAF.
- Rotate and invalidate session IDs and enforce short session timeouts to limit the value of any leaked identifier.
- Apply vendor patches from downstream distributions (Apple, openSUSE, Gentoo, IBM) where Tomcat is bundled.
- Monitor for anomalous session reuse or authentication from unexpected source addresses.
Detection
- Inspect web server and proxy logs for cookie values containing double quote characters or %5C sequences.
- Alert on session ID reuse across different client IP addresses or user agents.
- Correlate authentication events with sudden changes in session identifiers for the same account.
- Review Tomcat access logs for malformed Cookie headers targeting session cookies.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-5333 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-5333), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
