Apache Tomcat Manager Cross Site Scripting
| Reporter | Title | Published | Views | Family All 108 |
|---|---|---|---|---|
 | tomcat -- Cross-site scripting vulnerability | 12 Nov 201000:00 | – | freebsd |
 | Apache Tomcat 5.5.x < 5.5.32 HTML Manager Interface XSS | 11 Feb 201100:00 | – | nessus |
| Apache Tomcat 7.0.x < 7.0.6 Manager Interface XSS | 13 Feb 201100:00 | – | nessus |
| Apache Tomcat 7.0.x < 7.0.6 Cross-Site Scripting Vulnerability | 13 Feb 201100:00 | – | nessus |
| Apache Tomcat 5.5.x < 5.5.32 Cross-site Scripting Vulnerability | 11 Feb 201100:00 | – | nessus |
| Apache Tomcat 6.0.x < 6.0.30 Multiple Vulnerabilities | 11 Feb 201100:00 | – | nessus |
| CentOS 5 : tomcat5 (CESA-2011:1845) | 21 Dec 201100:00 | – | nessus |
| Debian DSA-2160-1 : tomcat6 - several vulnerabilities | 14 Feb 201100:00 | – | nessus |
| Fedora 14 : tomcat6-6.0.26-27.fc14 (2011-13457) | 21 Oct 201100:00 | – | nessus |
| FreeBSD : tomcat -- XSS vulnerability (553ec4ed-38d6-11e0-94b1-000c29ba66d2) | 16 Feb 201100:00 | – | nessus |
10
`-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
CVE-2011-0013 Apache Tomcat Manager XSS vulnerability
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected:
- - Tomcat 7.0.0 to 7.0.5
- - Tomcat 6.0.0 to 6.0.29
- - Tomcat 5.5.0 to 5.5.31
- - Earlier, unsupported versions may also be affected
Description:
The HTML Manager interface displayed web applciation provided data, such
as display names, without filtering. A malicious web application could
trigger script execution by an administartive user when viewing the
manager pages.
Example:
<display-name><script>alert('hi');</script></display-name>
Mitigation:
Users of affected versions should apply one of the following mitigations:
- - Upgrade to a Tomcat version where this issue is fixed
- - Undeploy untrusted web applications
- - Remove the Manager application
Credit:
The issue was identified by the Tomcat security team.
References:
http://tomcat.apache.org/security.html
http://tomcat.apache.org/security-7.html
http://tomcat.apache.org/security-6.html
http://tomcat.apache.org/security-5.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQIcBAEBAgAGBQJNTLB+AAoJEBDAHFovYFnnul0P/iupVkfHFjgIN5rkDHVoArfU
MkIcm5GMCqb1d0th8JmEtoFlI09sTJdGwyUbiC4hnuj/lA+BJuW/wDSzM2esfXGX
okraVm1SI6eI5DceQf/QzPZ9FIq3Z8mqixzBX959aQY1+JnW3Ah4vIYvZpaKpyi+
BMIj0JtIVEVNajAnUYQn9ruZg9FFX+t1Ajb6n+CJV3D4ux7XMGLFv2y5XPwVwJXm
AP/0jAHoMbjaRMwHrUxgkIDMpwpOcHFIfFq7zHjo9OTtL2LJ+vrB3FlxV6rZygMt
gwPeDeUoCCphrf1UncUzckW280/WGfsr3xncNEOpCG3o6xQkRV8eoGNikw5xZ2U8
YxLr4RdpJemUhx94jDYiMdT/gYyHbMfHtVsG3VObFp2yEjnLHU7HI6tI3C617nau
Czg1Z/YqnUvZfGDQDL5bXkF6dlWav9CmXuXht7gS3yskkYIJPJn0oZhAYweznK+v
Ua3jqNvsVktsGd76UtRh246Js6ie4EYmusZ3LqJQmsbkoPxkcAFuHCkZqVBR37SF
tt9yI7qUAb+022L+EGQkmjfcy0O9e4WKMXwf5ocywSDVAJH2/EuGTY1vAojHqGNO
hM88fdKus3Vfvj4vqzkAH+4LpdpPmK80xl+KxSJMBg+cWYLe6OGYEL7FbdoswcRv
cNZcMy4fbYmWPQkY+miZ
=sDwq
-----END PGP SIGNATURE-----
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
05 Feb 2011 00:00Current
5.7Medium risk
Vulners AI Score5.7
EPSS0.10228