Published: 09/03/2009 Updated: 13/02/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 up to and including 4.1.39, 5.5.0 up to and including 5.5.27, and 6.0.0 up to and including 6.0.18 allows remote malicious users to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML."

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache tomcat 4.1.2
apache tomcat 4.1.35
apache tomcat 4.1.36
apache tomcat 4.1.9
apache tomcat 5.5.18
apache tomcat 4.1.21
apache tomcat 6.0.6
apache tomcat 6.0.11
apache tomcat 5.5.12
apache tomcat 5.5.14
apache tomcat 4.1.24
apache tomcat 5.5.10
apache tomcat 5.5.4
apache tomcat 5.5.7
apache tomcat 5.5.1
apache tomcat 6.0.7
apache tomcat 5.5.11
apache tomcat 4.1.25
apache tomcat 6.0.4
apache tomcat 5.5.6
apache tomcat 5.5.26
apache tomcat 4.1.4
apache tomcat 5.5.20
apache tomcat 5.5.15
apache tomcat 5.5.5
apache tomcat 4.1.27
apache tomcat 6.0.15
apache tomcat 4.1.30
apache tomcat 4.1.7
apache tomcat 4.1.11
apache tomcat 5.5.21
apache tomcat 4.1.18
apache tomcat 5.5.22
apache tomcat 4.1.14
apache tomcat 6.0.10
apache tomcat 6.0.3
apache tomcat 4.1.19
apache tomcat 6.0.9
apache tomcat 4.1.31
apache tomcat 5.5.3
apache tomcat 4.1.16
apache tomcat 4.1.29
apache tomcat 4.1.22
apache tomcat 6.0
apache tomcat 4.1.5
apache tomcat 4.1.26
apache tomcat 4.1.13
apache tomcat 4.1.8
apache tomcat 5.5.9
apache tomcat 5.5.25
apache tomcat 6.0.0
apache tomcat 4.1.17
apache tomcat 6.0.14
apache tomcat 5.5.2
apache tomcat 4.1.33
apache tomcat 5.5.0
apache tomcat 4.1.1
apache tomcat 5.5.13
apache tomcat 6.0.1
apache tomcat 6.0.12
apache tomcat 5.5.24
apache tomcat 4.1.12
apache tomcat 4.1.28
apache tomcat 4.1.15
apache tomcat 4.1.3
apache tomcat 4.1.10
apache tomcat 5.5.8
apache tomcat 5.5.16
apache tomcat 4.1.0
apache tomcat 6.0.5
apache tomcat 4.1.20
apache tomcat 5.5.17
apache tomcat 5.5.19
apache tomcat 4.1.23
apache tomcat 4.1.34
apache tomcat 4.1.32
apache tomcat 4.1.37
apache tomcat 6.0.2
apache tomcat 6.0.13
apache tomcat 5.5.23
apache tomcat 4.1.6
apache tomcat 6.0.16
apache tomcat 6.0.8

Synopsis Important: tomcat5 security update Type/Severity Security Advisory: Important Topic Updated tomcat5 packages that fix multiple security issues are nowavailable for Red Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as havingimportant security impact Common Vulnerab ...

Synopsis Important: tomcat security update Type/Severity Security Advisory: Important Topic Updated tomcat packages that fix several security issues are now availablefor Red Hat Enterprise Linux 5This update has been rated as having important security impact by the RedHat Security Response Team D ...

Iida Minehiko discovered that Tomcat did not properly normalise paths A remote attacker could send specially crafted requests to the server and bypass security restrictions, gaining access to sensitive content (CVE-2008-5515) ...

Debian Bug report logs - #532363 CVE-2009-0033 CVE-2009-0580 CVE-2009-0783 CVE-2009-0781: Apache Tomcat 5 Multiple Vulnerabilities Package: tomcat5; Maintainer for tomcat5 is (unknown); Reported by: Giuseppe Iuculano <giuseppe@iuculanoit> Date: Mon, 8 Jun 2009 20:39:02 UTC Severity: serious Tags: patch, security Found i ...

Debian Bug report logs - #532362 CVE-2009-0033 CVE-2009-0580 CVE-2009-0783 CVE-2009-0781: Apache Tomcat 6 Multiple Vulnerabilities Package: tomcat6; Maintainer for tomcat6 is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Giuseppe Iuculano <giuseppe@iuculanoit> Date: Mon, 8 Jun ...

The calendar application for Apache Tomcat contains invalid HTML which renders the cross site scripting protection for the time parameter ineffective An attacker can therefore perform an cross site scripting attack using the time attribute Version affected include Tomcat 600 to 6018, Tomcat 550 to 5527, and Tomcat 410 to 4139 ...

CWE-79 http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-4.html http://tomcat.apache.org/security-5.html http://www.mandriva.com/security/advisories?name=MDVSA-2009:138 http://www.mandriva.com/security/advisories?name=MDVSA-2009:136 http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1 http://secunia.com/advisories/35685 http://secunia.com/advisories/35788 http://www.vupen.com/english/advisories/2009/1856 https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html http://secunia.com/advisories/37460 https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html http://www.vmware.com/security/advisories/VMSA-2009-0016.html http://www.vupen.com/english/advisories/2009/3316 https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html http://support.apple.com/kb/HT4077 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://marc.info/?l=bugtraq&m=129070310906557&w=2 http://www.vupen.com/english/advisories/2010/3056 http://secunia.com/advisories/42368 http://www.debian.org/security/2011/dsa-2207 http://marc.info/?l=bugtraq&m=136485229118404&w=2 http://marc.info/?l=bugtraq&m=133469267822771&w=2 http://marc.info/?l=bugtraq&m=127420533226623&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/49213 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6564 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19345 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11041 http://www.securityfocus.com/archive/1/507985/100/0/threaded http://www.securityfocus.com/archive/1/501538/100/0/threaded https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E https://access.redhat.com/errata/RHSA-2010:0580 https://nvd.nist.gov https://usn.ubuntu.com/788-1/

CVE-2009-0781

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect