CVE-2007-3382: Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats s...

Security readout for executives and security teams

CVE-2007-3382 is an old Apache Tomcat cookie parsing flaw. Affected versions may treat a single quote as a cookie delimiter, potentially exposing sensitive cookie values such as session IDs. If an exposed legacy Tomcat application still runs these versions, an attacker could hijack user sessions. Exposure is most likely in legacy Java web applications or vendor-packaged Tomcat deployments that were never upgraded from the listed versions. Modern Tomcat deployments should not be assumed affected unless version evidence matches the affected ranges. Prioritize remediation if any public or business-critical application still uses the affected Tomcat versions. The vulnerability is old, but session hijacking impact is material and legacy systems often remain overlooked. Mitigation focus: Upgrade Apache Tomcat beyond the listed affected version ranges.; Apply applicable vendor advisories for Debian, Red Hat, Fedora, Apple, HP, or IBM packages.; Retire unsupported legacy Tomcat runtimes where possible..

Prepared

Jun 29, 2026, 04:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.