Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
4.3
CVSSv2

CVE-2007-1355

Published: 21/05/2007 Updated: 07/11/2023
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 435
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Subscribe to Apache

Vulnerability Summary

Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 up to and including 4.0.6, 4.1.0 up to and including 4.1.36, 5.0.0 up to and including 5.0.30, 5.5.0 up to and including 5.5.23, and 6.0.0 up to and including 6.0.10 allow remote malicious users to inject arbitrary web script or HTML via the test parameter and unspecified vectors.

Vulnerable Product Search on Vulmon Subscribe to Product

apache tomcat 4.0.4

apache tomcat 5.0.8

apache tomcat 5.0.19

apache tomcat 6.0.6

apache tomcat 5.0.14

apache tomcat 4.1.24

apache tomcat 5.0.22

apache tomcat 5.0.7

apache tomcat 6.0.7

apache tomcat 6.0.4

apache tomcat 5.0.9

apache tomcat 5.0.15

apache tomcat 5.0.30

apache tomcat 5.0.23

apache tomcat 5.0.2

apache tomcat 5.0.10

apache tomcat 5.0.21

apache tomcat 5.0.26

apache tomcat 6.0.10

apache tomcat 6.0.3

apache tomcat 5.0.6

apache tomcat 6.0.9

apache tomcat 4.1.31

apache tomcat 5.0.27

apache tomcat 5.0.16

apache tomcat 4.0.6

apache tomcat 4.0.3

apache tomcat 5.0.18

apache tomcat 6.0.0

apache tomcat 4.0.1

apache tomcat 5.0.5

apache tomcat 5.0.28

apache tomcat 5.0.29

apache tomcat 6.0.1

apache tomcat 4.1.28

apache tomcat 5.0.13

apache tomcat 4.1.15

apache tomcat 4.1.10

apache tomcat 5.0.17

apache tomcat 6.0.5

apache tomcat 4.0.2

apache tomcat 4.0.5

apache tomcat 4.0.0

apache tomcat 5.0.4

apache tomcat 6.0.2

apache tomcat 5.0.25

apache tomcat 5.0.1

apache tomcat 5.0.11

apache tomcat 5.0.3

apache tomcat 5.0.24

apache tomcat 6.0.8

apache tomcat 5.0.12

Exploits

Exploit DB: Apache Tomcat 6.0.10 - Documentation Sample Application Multiple Cross-Site Scripting Vulnerabilities
source: wwwsecurityfocuscom/bid/24058/info Apache Tomcat's documentation web application includes a sample application that is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input An attacker may leverage these issues to execute arbitrary script code in the browser of an unsusp ...
Exploit DB: CVE-2007-1355.txt
The Tomcat documentation web application includes a sample application that contains multiple cross site scripting vulnerabilities Versions affected include Tomcat 400 to 406, Tomcat 410 to 4136, Tomcat 500 to 5030, Tomcat 550 to 5523, and Tomcat 600 to 6010 ...

References

NVD-CWE-Otherhttp://tomcat.apache.org/security-4.htmlhttp://tomcat.apache.org/security-5.htmlhttp://tomcat.apache.org/security-6.htmlhttp://www.securityfocus.com/bid/24058https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.htmlhttp://secunia.com/advisories/27037http://secunia.com/advisories/27727http://securityreason.com/securityalert/2722http://www.redhat.com/support/errata/RHSA-2008-0261.htmlhttp://support.apple.com/kb/HT2163http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.htmlhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1http://secunia.com/advisories/30802http://secunia.com/advisories/30908http://secunia.com/advisories/30899http://rhn.redhat.com/errata/RHSA-2008-0630.htmlhttp://secunia.com/advisories/31493http://secunia.com/advisories/33668http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspxhttp://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795http://www.vupen.com/english/advisories/2009/0233http://www.vupen.com/english/advisories/2007/3386http://www.vupen.com/english/advisories/2008/1979/referenceshttp://www.vupen.com/english/advisories/2008/1981/referenceshttp://osvdb.org/34875https://exchange.xforce.ibmcloud.com/vulnerabilities/34377https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6111http://www.securityfocus.com/archive/1/500412/100/0/threadedhttp://www.securityfocus.com/archive/1/500396/100/0/threadedhttp://www.securityfocus.com/archive/1/469067/100/0/threadedhttps://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3Ehttps://nvd.nist.govhttps://www.exploit-db.com/exploits/30052/
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
injectionCVE-2024-30983CVE-2023-4235CVE-2024-21338privilegeencryptionCVE-2023-4232CVE-2024-31497CVE-2024-32341
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook