GHSA-f98p-9pp6-7q6c
Apache Tomcat Cross-site scripting (XSS) vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2008-1947
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Description
Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to `host-manager/html/add`.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.tomcat:tomcat | introduced 5.5.9, fixed 5.5.27 |
| Maven · org.apache.tomcat:tomcat | introduced 6.0.0, fixed 6.0.18 |
| Maven · org.apache.tomcat.embed:tomcat-embed-core | introduced 5.5.9, fixed 5.5.27 |
| Maven · org.apache.tomcat.embed:tomcat-embed-core | introduced 6.0.0, fixed 6.0.18 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2008-1947 ADVISORY
- https://github.com/apache/tomcat/commit/ab6a6c41ac972c845717c9d639f0335865afab4d WEB
- https://github.com/apache/tomcat/commit/78ad0fcbe29c824f1f2e45a4e2716247b033250a WEB
- https://github.com/apache/tomcat/commit/49c71fc59c1b8f8da77aea9eb53e61db168aebab WEB
- https://github.com/apache/tomcat/commit/5f00d434c8dc11bd49ce0b4b56fe889839056030 WEB
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html WEB
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11534 WEB
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6009 WEB
- https://web.archive.org/web/20200514224656/http://www.securityfocus.com/archive/1/507985/100/0/threaded WEB
- https://web.archive.org/web/20201208011750/http://www.securityfocus.com/archive/1/492958/100/0/threaded WEB
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00712.html WEB
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00859.html WEB
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00889.html WEB
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E WEB
- https://github.com/apache/tomcat PACKAGE
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42816 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=446393 WEB
- https://access.redhat.com/security/cve/CVE-2008-1947 WEB
- https://access.redhat.com/errata/RHSA-2008:1007 WEB
- https://access.redhat.com/errata/RHSA-2008:0864 WEB
- https://access.redhat.com/errata/RHSA-2008:0862 WEB
- https://access.redhat.com/errata/RHSA-2008:0648 WEB
- http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html WEB
- http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html WEB
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html WEB
- http://marc.info/?l=bugtraq&m=123376588623823&w=2 WEB
- http://marc.info/?l=bugtraq&m=139344343412337&w=2 WEB
- http://marc.info/?l=tomcat-user&m=121244319501278&w=2 WEB
- http://support.apple.com/kb/HT3216 WEB
- http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm WEB
- http://tomcat.apache.org/security-5.html WEB
- http://tomcat.apache.org/security-6.html WEB
- http://www.debian.org/security/2008/dsa-1593 WEB
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:188 WEB
- http://www.redhat.com/support/errata/RHSA-2008-0648.html WEB
- http://www.redhat.com/support/errata/RHSA-2008-0862.html WEB
- http://www.redhat.com/support/errata/RHSA-2008-0864.html WEB
- http://www.vmware.com/security/advisories/VMSA-2009-0002.html WEB
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |