GHSA-wjwr-3jch-479j

Apache Tomcat SendMailServlet XSS

En bref

Publiée: 2022-05-01 18:13 UTC
Mise à jour: 2023-11-08 03:56 UTC
CVE: CVE-2007-3383

Description

Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (`examples/jsp/mail/sendmail.jsp`) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.

Paquets affectés

Paquet	Versions
Maven · org.apache.tomcat:tomcat	introduced 4.0.0, last affected 4.0.6
Maven · org.apache.tomcat:tomcat	introduced 4.1.0, last affected 4.1.36

Références

https://nvd.nist.gov/vuln/detail/CVE-2007-3383 ADVISORY
https://exchange.xforce.ibmcloud.com/vulnerabilities/35536 WEB
https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E WEB
https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E WEB
https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E WEB
http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html WEB
http://seclists.org/fulldisclosure/2007/Jul/0448.html WEB
http://support.apple.com/kb/HT2163 WEB
http://tomcat.apache.org/security-4.html WEB
http://www.kb.cert.org/vuls/id/862600 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database