PT-2001-1997 · Apache · Apache Tomcat

Published 2001-11-22 · Updated 2022-04-30 · CVE-2001-0829

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Tomcat version 3.2.1

Description A cross-site scripting issue allows a malicious webmaster to embed Javascript in a request for a .JSP file, causing the Javascript to be inserted into an error message. The default 404 error page does not escape URLs, enabling XSS attacks using specially crafted URLs.

Recommendations For Apache Tomcat version 3.2.1, consider modifying the default 404 error page to properly escape URLs as a temporary workaround. Restrict access to .JSP files to minimize the risk of exploitation until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2001-0829

GHSA-58HJ-575G-5J25

Affected Products

Apache Tomcat

References · 10

• 🔥 http://securityfocus.com/bid/2982 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-0829 · Security Note
• https://osv.dev/vulnerability/GHSA-58hj-575g-5j25 · Vendor Advisory
• http://jakarta.apache.org/tomcat/tomcat-3.2-doc/readme · Vendor Advisory
• https://tomcat.apache.org/security-3 · Note
• https://web.archive.org/web/20021108153830/http://online.securityfocus.com/bid/2982 · Note
• http://archive.cert.uni-stuttgart.de/archive/bugtraq/2001/07/msg00021.html · Note
• https://web.archive.org/web/20061208015126/http://archive.cert.uni-stuttgart.de/archive/bugtraq/2001/07/msg00021.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0829 · Note
• https://web.archive.org/web/20021201182720/http://jakarta.apache.org/tomcat/tomcat-3.2-doc/readme · Note