PT-2007-5880 · Apache · Apache Tomcat

Tushar Vartak · Publicado 2007-09-05 · Atualizado 2022-05-01 · CVE-2007-4724

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Apache Tomcat version 4.1.31

Description: A cross-site request forgery issue exists in the calendar examples application, specifically in cal2.jsp. This allows remote attackers to add events as arbitrary users by manipulating the time and description parameters.

Recommendations: For Apache Tomcat version 4.1.31, as a temporary workaround, consider restricting access to the cal2.jsp page in the calendar examples application until a patch is available. Avoid using the time and description parameters in the affected page until the issue is resolved.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2007-4724

GHSA-G77G-VJJM-X83J

Produtos afetados

Apache Tomcat

Referências · 10

• https://web.archive.org/web/20081006123851/http://archives.neohapsis.com/archives/bugtraq/2007-09/0040.html · Nota
• http://archives.neohapsis.com/archives/bugtraq/2007-09/0040.html · Nota
• http://osvdb.org/41029 · Nota
• http://securityfocus.com/archive/1/478491/100/0/threaded · Nota
• https://web.archive.org/web/20070911063436/http://securityreason.com/securityalert/3094 · Nota
• https://web.archive.org/web/20200526022330/http://securityfocus.com/archive/1/478491/100/0/threaded · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4724 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4724 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-g77g-vjjm-x83j · Aviso do Fabricante
• http://securityreason.com/securityalert/3094 · Nota