tomcat -- XSS vulnerability in sample applications

2007-05-1900:00:00

vuxml.freebsd.org

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.079 Low

EPSS

Percentile

94.2%

JSON

The Apache Project reports:

The JSP and Servlet included in the sample application within
the Tomcat documentation webapp did not escape user provided
data before including it in the output. This enabled a XSS
attack. These pages have been simplified not to use any user
provided data in the output.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchapache-tomcat< 6.0.11UNKNOWN
FreeBSDanynoarchtomcat< 5.5.24UNKNOWN
FreeBSDanynoarchjakarta-tomcat< 5.5.24UNKNOWN