PT-2006-7519 · Apache+2 · Apache Tomcat+2

Published 2006-12-18 · Updated 2022-05-01 · CVE-2007-1358

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 4.0.0 through 4.0.6 Apache Tomcat versions 4.1.0 through 4.1.34

Description: The issue allows remote attackers to inject arbitrary web script or HTML via crafted Accept-Language headers that do not conform to RFC 2616, potentially leading to cross-site scripting (XSS) attacks.

Recommendations: For Apache Tomcat versions 4.0.0 through 4.0.6, update to a version outside of this range to mitigate the risk. For Apache Tomcat versions 4.1.0 through 4.1.34, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the Accept-Language header to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-1358

GHSA-XMC9-6P56-3C4V

HPSBUX02262

RHSA-2007:0326

RHSA-2007:0327

RHSA-2007:0328

RHSA-2007:0360

RHSA-2007:0876

RHSA-2007_0327

RHSA-2008:0261

RHSA-2008:0524

RHSA-2008:0630

RHSA-2010:0602

Affected Products

Apache Tomcat

Hp-Ux

Red Hat

References · 74

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/apache_modjk_overflow.rb · Exploit
• http://secunia.com/advisories/27727 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1887 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0774 · Security Note
• http://secunia.com/advisories/31493 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1 · Vendor Advisory
• http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html · Vendor Advisory
• http://secunia.com/advisories/33668 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1863 · Security Note
• http://rhn.redhat.com/errata/RHSA-2008-0630.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1358 · Security Note
• http://tomcat.apache.org/security-4.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3382 · Security Note
• https://osv.dev/vulnerability/GHSA-xmc9-6p56-3c4v · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2007-November/msg00525.html · Vendor Advisory