CVE-2007-3384: Multiple cross-site scripting (XSS) vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3...

Security readout for executives and security teams

This CVE describes cross-site scripting in an example Apache Tomcat servlet, CookieExample, in Tomcat 3.3 through 3.3.2. If that example is reachable, an attacker could inject script or HTML through cookie name or value fields. Business impact depends on whether legacy Tomcat examples are still deployed. Exposure is most likely in legacy Tomcat 3.3.x deployments where bundled example servlets remain publicly reachable. Modern Tomcat installations or systems without the examples application exposed are less likely to be affected, based on the provided description. Handle as a moderate legacy exposure cleanup. It is not KEV-listed in the supplied data, but publicly reachable sample applications on obsolete Tomcat can create avoidable browser-side compromise risk. Mitigation focus: Inventory any Apache Tomcat 3.3 through 3.3.2 systems.; Remove or disable the exposed examples web application if present.; Check Apache Tomcat security guidance for the supported remediation path..

Prepared

Jun 29, 2026, 04:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.