CVE-2007-1355 Apache Tomcat Vulnerable to Cross-Site Scripting
MediumCVSS 4.3
EPSS 58.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomcat | = 4.0.0 | No fix listed |
| apache tomcat | = 4.0.1 | No fix listed |
| apache tomcat | = 4.0.2 | No fix listed |
| apache tomcat | = 4.0.3 | No fix listed |
| apache tomcat | = 4.0.4 | No fix listed |
| apache tomcat | = 4.0.5 | No fix listed |
| apache tomcat | = 4.0.6 | No fix listed |
| apache tomcat | = 4.1.10 | No fix listed |
| apache tomcat | = 4.1.15 | No fix listed |
| apache tomcat | = 4.1.24 | No fix listed |
| apache tomcat | = 4.1.28 | No fix listed |
| apache tomcat | = 4.1.31 | No fix listed |
| apache tomcat | = 5.0.1 | No fix listed |
| apache tomcat | = 5.0.2 | No fix listed |
| apache tomcat | = 5.0.3 | No fix listed |
| apache tomcat | = 5.0.4 | No fix listed |
| apache tomcat | = 5.0.5 | No fix listed |
| apache tomcat | = 5.0.6 | No fix listed |
| apache tomcat | = 5.0.7 | No fix listed |
| apache tomcat | = 5.0.8 | No fix listed |
| apache tomcat | = 5.0.9 | No fix listed |
| apache tomcat | = 5.0.10 | No fix listed |
| apache tomcat | = 5.0.11 | No fix listed |
| apache tomcat | = 5.0.12 | No fix listed |
| apache tomcat | = 5.0.13 | No fix listed |
Show 37 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomcat | = 5.0.14 | No fix listed |
| apache tomcat | = 5.0.15 | No fix listed |
| apache tomcat | = 5.0.16 | No fix listed |
| apache tomcat | = 5.0.17 | No fix listed |
| apache tomcat | = 5.0.18 | No fix listed |
| apache tomcat | = 5.0.19 | No fix listed |
| apache tomcat | = 5.0.21 | No fix listed |
| apache tomcat | = 5.0.22 | No fix listed |
| apache tomcat | = 5.0.23 | No fix listed |
| apache tomcat | = 5.0.24 | No fix listed |
| apache tomcat | = 5.0.25 | No fix listed |
| apache tomcat | = 5.0.26 | No fix listed |
| apache tomcat | = 5.0.27 | No fix listed |
| apache tomcat | = 5.0.28 | No fix listed |
| apache tomcat | = 5.0.29 | No fix listed |
| apache tomcat | = 5.0.30 | No fix listed |
| apache tomcat | = 6.0.0 | No fix listed |
| apache tomcat | = 6.0.1 | No fix listed |
| apache tomcat | = 6.0.2 | No fix listed |
| apache tomcat | = 6.0.3 | No fix listed |
| apache tomcat | = 6.0.4 | No fix listed |
| apache tomcat | = 6.0.5 | No fix listed |
| apache tomcat | = 6.0.6 | No fix listed |
| apache tomcat | = 6.0.7 | No fix listed |
| apache tomcat | = 6.0.8 | No fix listed |
| apache tomcat | = 6.0.9 | No fix listed |
| apache tomcat | = 6.0.10 | No fix listed |
| org.apache.tomcat/jsp-api(Maven) | >= 4.1.0, < 4.1.37 | 4.1.37 |
| org.apache.tomcat/jsp-api(Maven) | >= 5.5.0, < 5.5.24 | 5.5.24 |
| org.apache.tomcat/jsp-api(Maven) | >= 6.0.0, < 6.0.11 | 6.0.11 |
| org.apache.tomcat/jsp-api(Maven) | >= 5.0.0, <= 5.0.30 | No fix listed |
| org.apache.tomcat/jsp-api(Maven) | >= 4.0.0, <= 4.0.6 | No fix listed |
| org.apache.tomcat/servlet-api(Maven) | >= 4.1.0, < 4.1.37 | 4.1.37 |
| org.apache.tomcat/servlet-api(Maven) | >= 5.5.0, < 5.5.24 | 5.5.24 |
| org.apache.tomcat/servlet-api(Maven) | >= 6.0.0, < 6.0.11 | 6.0.11 |
| org.apache.tomcat/servlet-api(Maven) | >= 5.0.0, <= 5.0.30 | No fix listed |
| org.apache.tomcat/servlet-api(Maven) | >= 4.0.0, <= 4.0.6 | No fix listed |
References
- community.ca.com
- SSRT071447 vendor-advisory
- APPLE-SA-2008-06-30 vendor-advisory
- 34875 vdb-entry
- RHSA-2008:0630 vendor-advisory
- 27037 third-party-advisory
- 27727 third-party-advisory
- 30802 third-party-advisory
- 30899 third-party-advisory
- 30908 third-party-advisory
- 31493 third-party-advisory
- 33668 third-party-advisory
- 2722 third-party-advisory
- 239312 vendor-advisory
- support.apple.com
- support.ca.com
- tomcat.apache.org
- tomcat.apache.org
- tomcat.apache.org
- RHSA-2008:0261 vendor-advisory
- 20070519 [CVE-2007-1355] Tomcat documentation XSS vulnerabilities mailing-list
- 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities mailing-list
- 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1) mailing-list
- 24058 exploit patch vdb-entry
- ADV-2007-3386 vdb-entry
- ADV-2008-1979 vdb-entry
- ADV-2008-1981 vdb-entry
- ADV-2009-0233 vdb-entry
- tomcat-hello-xss(34377) vdb-entry
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ mailing-list
- oval:org.mitre.oval:def:6111 signature vdb-entry
- FEDORA-2007-3456 vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- lists.apache.org
- lists.apache.org
- lists.apache.org
- github.com