PT-2007-2752 · Apache+1 · Apache Tomcat+1

Published 2007-05-21 · Updated 2022-05-01 · CVE-2007-1355

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 4.0.0 through 4.0.6 Apache Tomcat versions 4.1.0 through 4.1.36 Apache Tomcat versions 5.0.0 through 5.0.30 Apache Tomcat versions 5.5.0 through 5.5.23 Apache Tomcat versions 6.0.0 through 6.0.10

Description The issue allows remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors, which can lead to cross-site scripting (XSS) attacks.

Recommendations For Apache Tomcat versions 4.0.0 through 4.0.6, update to a version outside of this range to mitigate the risk. For Apache Tomcat versions 4.1.0 through 4.1.36, update to a version outside of this range to mitigate the risk. For Apache Tomcat versions 5.0.0 through 5.0.30, update to a version outside of this range to mitigate the risk. For Apache Tomcat versions 5.5.0 through 5.5.23, update to a version outside of this range to mitigate the risk. For Apache Tomcat versions 6.0.0 through 6.0.10, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the test parameter in the affected application to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-1355

GHSA-4C6X-GFC8-C26R

HPSBUX02262

RHSA-2008:0261

RHSA-2008:0524

RHSA-2008:0630

Affected Products

Apache Tomcat

Hp-Ux

References · 46

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/apache_modjk_overflow.rb · Exploit
• 🔥 https://exploit-db.com/exploits/30052 · Exploit
• 🔥 http://securityfocus.com/bid/24058 · Exploit
• http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1355 · Security Note
• https://redhat.com/archives/fedora-package-announce/2007-November/msg00525.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2008-0630.html · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0261.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4c6x-gfc8-c26r · Vendor Advisory
• https://github.com/apache/tomcat · Note
• http://tomcat.apache.org/security-4.html · Note
• http://vupen.com/english/advisories/2008/1979/references · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1355 · Note