PT-2007-1472 · Apache+1 · Apache Tomcat+1

Published 2007-05-09 · Updated 2023-02-13 · CVE-2006-7195

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.0.0 through 5.0.30 Apache Tomcat versions 5.5.0 through 5.5.17

Description A cross-site scripting (XSS) issue exists due to unfiltered header values in the implicit-objects.jsp file of the examples webapp, allowing remote attackers to inject arbitrary web script or HTML. This enables a XSS attack.

Recommendations For Apache Tomcat versions 5.0.0 through 5.0.30, filter the header values in the implicit-objects.jsp file to prevent XSS attacks. For Apache Tomcat versions 5.5.0 through 5.5.17, filter the header values in the implicit-objects.jsp file to prevent XSS attacks.

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2006-7195

GHSA-P57V-P3FX-QGWM

RHSA-2007:0326

RHSA-2007:0327

RHSA-2007:0328

RHSA-2007:0340

RHSA-2007_0327

RHSA-2008:0261

RHSA-2008:0524

Affected Products

Apache Tomcat

Red Hat

References · 35

• https://osv.dev/vulnerability/GHSA-p57v-p3fx-qgwm · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0327.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-7195 · Security Note
• http://redhat.com/support/errata/RHSA-2008-0261.html · Vendor Advisory
• https://github.com/apache/tomcat · Note
• http://secunia.com/advisories/33668 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=237081 · Note
• http://lists.vmware.com/pipermail/security-announce/2008/000003.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10514 · Note
• https://access.redhat.com/errata/RHSA-2007:0326 · Note
• http://securityfocus.com/archive/1/500396/100/0/threaded · Note
• http://securityfocus.com/bid/28481 · Note
• http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540 · Note
• http://vupen.com/english/advisories/2007/1729 · Note
• https://web.archive.org/web/20080515114843/http://securityfocus.com/bid/28481 · Note