GHSA-5c5p-jxvx-x7j2
Apache Tomcat vulnerable to Cross-site Scripting
At a glance
- Published
- Updated
- CVE
- CVE-2007-2450
Description
Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.tomcat:tomcat | introduced 4.0.0, last affected 4.0.6 |
| Maven · org.apache.tomcat:tomcat | introduced 4.1.0, fixed 4.1.37 |
| Maven · org.apache.tomcat:tomcat | introduced 5.0.0, last affected 5.0.30 |
| Maven · org.apache.tomcat:tomcat | introduced 5.5.0, fixed 5.5.25 |
| Maven · org.apache.tomcat:tomcat | introduced 6.0.0, fixed 6.0.14 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2007-2450 ADVISORY
- https://github.com/apache/tomcat/commit/1bc3bcb2848f478fd6674487d6dad507fd5dd686 WEB
- https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html WEB
- https://web.archive.org/web/20201207215920/https://cxsecurity.com/issue/WLB-2007060074 WEB
- https://web.archive.org/web/20200809062244/http://www.securityfocus.com/archive/1/471357/100/0/threaded WEB
- https://web.archive.org/web/20200517153851/http://www.securityfocus.com/archive/1/500412/100/0/threaded WEB
- https://web.archive.org/web/20200517122628/http://www.securityfocus.com/archive/1/500396/100/0/threaded WEB
- https://web.archive.org/web/20200229180652/http://www.securityfocus.com/bid/24475 WEB
- https://web.archive.org/web/20120809122231/http://secunia.com/advisories/30908 WEB
- https://web.archive.org/web/20090623202429/http://secunia.com/advisories/33668 WEB
- https://web.archive.org/web/20080801210056/http://secunia.com/advisories/30802 WEB
- https://web.archive.org/web/20080801204240/http://secunia.com/advisories/30899 WEB
- https://web.archive.org/web/20080724125033/http://secunia.com/advisories/27037 WEB
- https://web.archive.org/web/20080413164556/http://securitytracker.com/alerts/2007/Jun/1018245.html WEB
- https://web.archive.org/web/20080324012730/http://secunia.com/advisories/28549 WEB
- https://web.archive.org/web/20080320042501/http://secunia.com/advisories/27727 WEB
- https://web.archive.org/web/20080212014926/http://secunia.com/advisories/26076 WEB
- https://web.archive.org/web/20071203205513/http://secunia.com/advisories/25678 WEB
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11287 WEB
- https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E WEB
- https://github.com/apache/tomcat PACKAGE
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34868 WEB
- http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx WEB
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795 WEB
- http://jvn.jp/jp/JVN%2307100457/index.html WEB
- http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html WEB
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html WEB
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1 WEB
- http://support.apple.com/kb/HT2163 WEB
- http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540 WEB
- http://tomcat.apache.org/security-4.html WEB
- http://tomcat.apache.org/security-5.html WEB
- http://tomcat.apache.org/security-6.html WEB
- http://www.debian.org/security/2008/dsa-1468 WEB
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:241 WEB
- http://www.redhat.com/support/errata/RHSA-2007-0569.html WEB
- http://www.redhat.com/support/errata/RHSA-2008-0261.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |