Published: 14/06/2007 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 435

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 up to and including 4.0.6, 4.1.0 up to and including 4.1.36, 5.0.0 up to and including 5.0.30, 5.5.0 up to and including 5.5.24, and 6.0.0 up to and including 6.0.13 allow remote malicious users to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache tomcat 4.0.4
apache tomcat 5.5.18
apache tomcat 5.0.8
apache tomcat 5.0.19
apache tomcat 6.0.6
apache tomcat 6.0.11
apache tomcat 5.5.12
apache tomcat 5.0.14
apache tomcat 5.5.14
apache tomcat 5.5.10
apache tomcat 5.0.22
apache tomcat 5.5.4
apache tomcat 5.5.7
apache tomcat 5.5.1
apache tomcat 5.0.7
apache tomcat 6.0.7
apache tomcat 5.5.11
apache tomcat 6.0.4
apache tomcat 5.5.6
apache tomcat 5.0.9
apache tomcat 5.0.15
apache tomcat 5.0.30
apache tomcat 5.5.20
apache tomcat 5.5.15
apache tomcat 5.0.23
apache tomcat 5.0.2
apache tomcat 5.5.5
apache tomcat 5.0.10
apache tomcat 5.0.21
apache tomcat 5.0.26
apache tomcat 5.5.21
apache tomcat 5.5.22
apache tomcat 6.0.10
apache tomcat 6.0.3
apache tomcat 5.0.0
apache tomcat 5.0.6
apache tomcat 5.5.3
apache tomcat 5.0.27
apache tomcat 5.0.16
apache tomcat 5.5.9
apache tomcat 4.0.3
apache tomcat 5.0.18
apache tomcat 6.0.0
apache tomcat 4.0.1
apache tomcat 5.5.2
apache tomcat 5.0.5
apache tomcat 5.0.28
apache tomcat 5.0.29
apache tomcat 5.5.0
apache tomcat 5.5.13
apache tomcat 6.0.1
apache tomcat 6.0.12
apache tomcat 5.0.13
apache tomcat
apache tomcat 5.5.8
apache tomcat 5.0.17
apache tomcat 5.5.16
apache tomcat 6.0.5
apache tomcat 4.0.2
apache tomcat 5.5.17
apache tomcat 5.5.19
apache tomcat 4.0.5
apache tomcat 4.0.0
apache tomcat 5.0.4
apache tomcat 6.0.2
apache tomcat 5.0.25
apache tomcat 6.0.13
apache tomcat 5.0.1
apache tomcat 5.0.11
apache tomcat 5.0.3
apache tomcat 5.0.24
apache tomcat 6.0.8
apache tomcat 5.0.12

source: wwwsecurityfocuscom/bid/24476/info Apache Tomcat is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website As a result, the att ...

Apache Tomcat versions 400 to 406, 410 to 4136, 500 to 5030, 550 to 5524, and 600 to 6013 suffer from a cross site scripting flaw in their JSP examples ...

NVD-CWE-Other http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-4.html http://tomcat.apache.org/security-5.html https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html http://www.redhat.com/support/errata/RHSA-2007-0569.html http://www.securityfocus.com/bid/24476 http://www.securitytracker.com/id?1018245 http://secunia.com/advisories/26076 http://secunia.com/advisories/27037 http://secunia.com/advisories/27727 http://securityreason.com/securityalert/2804 http://www.mandriva.com/security/advisories?name=MDKSA-2007:241 http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00008.html http://secunia.com/advisories/29392 http://www.redhat.com/support/errata/RHSA-2008-0261.html http://support.apple.com/kb/HT2163 http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html http://secunia.com/advisories/30802 http://secunia.com/advisories/31493 http://rhn.redhat.com/errata/RHSA-2008-0630.html http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx http://secunia.com/advisories/33668 http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540 http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795 http://www.vupen.com/english/advisories/2009/0233 http://www.vupen.com/english/advisories/2007/2213 http://www.vupen.com/english/advisories/2007/3386 http://www.vupen.com/english/advisories/2008/1981/references http://osvdb.org/36080 https://exchange.xforce.ibmcloud.com/vulnerabilities/34869 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10578 http://www.securityfocus.com/archive/1/500412/100/0/threaded http://www.securityfocus.com/archive/1/500396/100/0/threaded http://www.securityfocus.com/archive/1/471351/100/0/threaded https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E https://nvd.nist.gov https://www.exploit-db.com/exploits/30189/

CVE-2007-2449

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect