Published: 14/08/2007 Updated: 16/10/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 435

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote malicious users to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache tomcat 5.5.18
apache tomcat 6.0.6
apache tomcat 6.0.11
apache tomcat 5.5.12
apache tomcat 5.5.14
apache tomcat 5.5.10
apache tomcat 5.5.4
apache tomcat 5.5.7
apache tomcat 5.5.1
apache tomcat 6.0.7
apache tomcat 5.5.11
apache tomcat 6.0.4
apache tomcat 5.5.6
apache tomcat 5.5.20
apache tomcat 5.5.15
apache tomcat 5.5.5
apache tomcat 5.5.21
apache tomcat 5.5.22
apache tomcat 6.0.10
apache tomcat 6.0.3
apache tomcat 6.0.9
apache tomcat 5.5.3
apache tomcat 5.5.9
apache tomcat 6.0.0
apache tomcat 5.5.2
apache tomcat 5.5.0
apache tomcat 5.5.13
apache tomcat 6.0.1
apache tomcat 6.0.12
apache tomcat 5.5.24
apache tomcat 5.5.8
apache tomcat 5.5.16
apache tomcat 6.0.5
apache tomcat 5.5.17
apache tomcat 5.5.19
apache tomcat 6.0.2
apache tomcat 6.0.13
apache tomcat 5.5.23
apache tomcat 6.0.8

source: wwwsecurityfocuscom/bid/25314/info Apache Tomcat Host Manager Servlet is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input An attacker can exploit this vulnerability to inject HTML and script code into the browser of an unsuspecting victim The attacker may then ...

Tomcat versions 550 to 5524 and 600 to 6013 suffer from a cross site scripting vulnerability in the host manager functionality ...

CWE-79 http://tomcat.apache.org/security-6.html http://jvn.jp/jp/JVN%2359851336/index.html https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html http://www.redhat.com/support/errata/RHSA-2007-0871.html http://www.securityfocus.com/bid/25314 http://securitytracker.com/id?1018558 http://secunia.com/advisories/26465 http://secunia.com/advisories/26898 http://secunia.com/advisories/27037 http://secunia.com/advisories/27267 http://secunia.com/advisories/27727 http://securityreason.com/securityalert/3010 http://www.debian.org/security/2008/dsa-1447 http://www.mandriva.com/security/advisories?name=MDKSA-2007:241 http://secunia.com/advisories/28317 http://osvdb.org/36417 http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540 http://secunia.com/advisories/33668 http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html http://www.vupen.com/english/advisories/2009/0233 http://www.vupen.com/english/advisories/2007/2880 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795 http://www.vupen.com/english/advisories/2007/3386 http://www.vupen.com/english/advisories/2007/3527 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554 https://exchange.xforce.ibmcloud.com/vulnerabilities/36001 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10077 http://www.securityfocus.com/archive/1/500412/100/0/threaded http://www.securityfocus.com/archive/1/500396/100/0/threaded http://www.securityfocus.com/archive/1/476448/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/30495/

CVE-2007-3386

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect