Lucene search
CVE-2007-1355.txt
Tomcat documentation XSS vulnerabilities, Tomcat versions 4.0.0 to 6.0.10 affected, discovered by Ferruh Mavitun
Show more
| Reporter | Title | Published | Views | Family All 59 |
|---|---|---|---|---|
 | CVE-2007-1355 | 21 May 200720:00 | – | cvelist |
 | Tomcat Sample App hello.jsp 'test' Parameter XSS | 21 May 200700:00 | – | nessus |
| FreeBSD : tomcat -- XSS vulnerability in sample applications (ab2575d6-39f0-11dc-b8cc-000fea449b8a) | 27 Jul 200700:00 | – | nessus |
| Apache Tomcat < 6.0.13 Multiple Vulnerabilities | 18 Nov 201100:00 | – | nessus |
| Fedora 8 : tomcat5-5.5.25-1jpp.1.fc8 (2007-3474) | 20 Nov 200700:00 | – | nessus |
| Fedora 7 : tomcat5-5.5.25-1jpp.1.fc7 (2007-3456) | 20 Nov 200700:00 | – | nessus |
| Apache Tomcat 4.x < 4.1.37 Multiple Vulnerabilities | 16 Jun 201000:00 | – | nessus |
| RHEL 4 : Satellite Server (RHSA-2008:0630) | 10 Jan 201000:00 | – | nessus |
| Fedora 8 : tomcat5-5.5.26-1jpp.2.fc8 (2008-1603) | 14 Feb 200800:00 | – | nessus |
| Fedora 7 : tomcat5-5.5.26-1jpp.2.fc7 (2008-1467) | 14 Feb 200800:00 | – | nessus |
10
`-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
CVE-2007-1355: Tomcat documentation XSS vulnerabilities
Severity:
Moderate (Cross-site scripting)
Vendor:
The Apache Software Foundation
Versions Affected:
Tomcat 4.0.0 to 4.0.6
Tomcat 4.1.0 to 4.1.36
Tomcat 5.0.0 to 5.0.30
Tomcat 5.5.0 to 5.5.23
Tomcat 6.0.0 to 6.0.10
Description:
The Tomcat documentation web application includes a sample application
that contains multiple XSS vulnerabilities.
Mitigation:
Undeploy the Tomcat documentation web application.
Credit:
These issues were discovered by Ferruh Mavituna.
Example:
http://server/tomcat-docs/appdev/sample/web/hello.jsp?test=<script>alert(document.domain)</script>
References:
http://tomcat.apache.org/security.html
Mark Thomas
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFGTxLXb7IeiTPGAkMRAhPzAKDxibK3Cn9Dq+2ZrlhZszmwPAJufACfdvjv
AH8zWtQXPUbBVgDS+6KoNOE=
=/6Zd
-----END PGP SIGNATURE-----
`
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo22 May 2007 00:00Current
9.2High risk
Vulners AI Score9.2
EPSS0.11009