PT-2008-3473 · Apache+2 · Apache Tomcat+2

CVE-2008-1947 · Publicado 2008-06-04 · Atualizado 2023-02-13

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.9 through 5.5.26 Apache Tomcat versions 6.0.0 through 6.0.16

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the name parameter (also known as the hostname attribute) to the host-manager/html/add endpoint. This occurs because the Host Manager web application did not properly escape user-provided data before including it in the output, enabling a XSS attack. The application now filters the data before use.

Recommendations For Apache Tomcat versions 5.5.9 through 5.5.26, consider updating to a version outside of this range to mitigate the risk. For Apache Tomcat versions 6.0.0 through 6.0.16, consider updating to a version outside of this range to mitigate the risk. As a temporary workaround, logging out (closing the browser) of the Host Manager web application once management tasks have been completed may help mitigate the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-1947

DSA-1593-1

GHSA-F98P-9PP6-7Q6C

HPSBUX02401

RHSA-2008:0648

RHSA-2008:0862

RHSA-2008:0864

RHSA-2008:1007

RHSA-2008_0648

Produtos afetados

Apache Tomcat

Hp-Ux

Red Hat

Referências · 77

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/tomcat_utf8_traversal.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/trendmicro_dlp_traversal.rb · Exploit
• https://github.com/apache/tomcat · Nota
• https://github.com/apache/tomcat/commit/5f00d434c8dc11bd49ce0b4b56fe889839056030 · Nota
• https://github.com/apache/tomcat/commit/ab6a6c41ac972c845717c9d639f0335865afab4d · Nota
• https://github.com/apache/tomcat/commit/78ad0fcbe29c824f1f2e45a4e2716247b033250a · Nota
• https://github.com/apache/tomcat/commit/49c71fc59c1b8f8da77aea9eb53e61db168aebab · Nota
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00889.html · Aviso do Fabricante
• https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E · Nota
• http://redhat.com/support/errata/RHSA-2008-0864.html · Aviso do Fabricante
• http://tomcat.apache.org/security-5.html · Nota
• http://secunia.com/advisories/30500 · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/0503 · Nota
• https://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11534 · Nota