PT-2007-4658 · Apache · Apache Tomcat

Tomasz Kuczynski · Publicado 2007-07-25 · Atualizado 2022-05-01 · CVE-2007-3383

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 4.0.0 through 4.0.6 Apache Tomcat versions 4.1.0 through 4.1.36

Description A cross-site scripting (XSS) issue exists in the SendMailServlet of the examples web application, allowing remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields. This is related to the generation of error messages, which did not properly escape user-provided data.

Recommendations For Apache Tomcat versions 4.0.0 through 4.0.6, consider undeploying the examples web application to mitigate the risk. For Apache Tomcat versions 4.1.0 through 4.1.36, consider undeploying the examples web application to mitigate the risk. As a temporary workaround, consider disabling the SendMailServlet until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-80

Identificadores relacionados

CVE-2007-3383

GHSA-WJWR-3JCH-479J

Produtos afetados

Apache Tomcat

Referências · 23

• http://tomcat.apache.org/security-4.html · Correção
• https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3383 · Nota
• http://kb.cert.org/vuls/id/862600 · Correção
• http://vupen.com/english/advisories/2007/2618 · Nota
• https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E · Nota
• http://vupen.com/english/advisories/2008/1981/references · Nota
• http://securityfocus.com/archive/1/474413/100/0/threaded · Nota
• http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html · Aviso do Fabricante
• http://support.apple.com/kb/HT2163 · Nota
• https://tomcat.apache.org/security-4 · Nota
• https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3383 · Nota de Segurança
• http://seclists.org/fulldisclosure/2007/Jul/0448.html · Correção