JVN#64851600 Apache Tomcat sample web application cross-site scripting vulnerability

Apache Tomcat from the Apache Software Foundation is an implementation of the Java Servlet and JavaServer Page (JSP) technologies.
jsp-examples, a sample web application included in Apache Tomcat, contains a cross-site scripting vulnerability.

Impact

An arbitrary script may be executed on the user’s web browser.

Solution

Update the Software
Update to Apache Tomcat 6.0.14, available from the developer as of August 9, 2007.

Workarounds
Avoid installing the sample program.
We recommend that users of Apache Tomcat 4.x and 5.x apply the above workaround, as the latest version is not available yet.

Products Affected

• Apache Tomcat 4.0.0 - 4.0.6
• Apache Tomcat 4.1.0 - 4.1.36
• Apache Tomcat 5.0.0 - 5.0.30
• Apache Tomcat 5.5.0 - 5.5.24
• Apache Tomcat 6.0.0 - 6.0.13