CVE-2002-1567 Apache Tomcat XSS Vulnerability
MediumCVSS 6.8
EPSS 27.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomcat | = 4.1.0 | No fix listed |
| org.apache.tomcat/tomcat(Maven) | >= 4.1.0, < 4.1.29 | 4.1.29 |
References
- 20020821 Apache Tomcat 4.1 Cross-Site Scripting Vulnerability exploit mailing-list vendor-advisory
- tomcat.apache.org
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ mailing-list
- nvd.nist.gov third-party-advisory vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- web.archive.org
- github.com