PT-2001-1997 · Apache · Apache Tomcat

Publicado 2001-11-22 · Atualizado 2022-04-30 · CVE-2001-0829

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Tomcat version 3.2.1

Description A cross-site scripting issue allows a malicious webmaster to embed Javascript in a request for a .JSP file, causing the Javascript to be inserted into an error message. The default 404 error page does not escape URLs, enabling XSS attacks using specially crafted URLs.

Recommendations For Apache Tomcat version 3.2.1, consider modifying the default 404 error page to properly escape URLs as a temporary workaround. Restrict access to .JSP files to minimize the risk of exploitation until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-80

Identificadores relacionados

CVE-2001-0829

GHSA-58HJ-575G-5J25

Produtos afetados

Apache Tomcat

Referências · 10

• 🔥 http://securityfocus.com/bid/2982 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-0829 · Nota de Segurança
• https://tomcat.apache.org/security-3 · Nota
• https://web.archive.org/web/20021108153830/http://online.securityfocus.com/bid/2982 · Nota
• http://archive.cert.uni-stuttgart.de/archive/bugtraq/2001/07/msg00021.html · Nota
• https://osv.dev/vulnerability/GHSA-58hj-575g-5j25 · Aviso do Fabricante
• https://web.archive.org/web/20061208015126/http://archive.cert.uni-stuttgart.de/archive/bugtraq/2001/07/msg00021.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0829 · Nota
• https://web.archive.org/web/20021201182720/http://jakarta.apache.org/tomcat/tomcat-3.2-doc/readme · Nota
• http://jakarta.apache.org/tomcat/tomcat-3.2-doc/readme · Aviso do Fabricante