PT-2007-3774 · Apache+2 · Apache Tomcat+2

Published 2007-06-14 · Updated 2022-05-01 · CVE-2007-2449

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 4.0.0 through 4.0.6 Apache Tomcat versions 4.1.0 through 4.1.36 Apache Tomcat versions 5.0.0 through 5.0.30 Apache Tomcat versions 5.5.0 through 5.5.24 Apache Tomcat versions 6.0.0 through 6.0.13

Description The issue allows remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ; character. This can be demonstrated by a URI containing a sequence such as snp/snoop.jsp;. The vulnerability is related to certain JSP files in the examples web application.

Recommendations For Apache Tomcat versions 4.0.0 through 4.0.6, consider disabling the examples web application until a patch is available. For Apache Tomcat versions 4.1.0 through 4.1.36, restrict access to the vulnerable JSP files in the examples web application to minimize the risk of exploitation. For Apache Tomcat versions 5.0.0 through 5.0.30, avoid using URIs that contain sequences after the ; character in the examples web application. For Apache Tomcat versions 5.5.0 through 5.5.24, consider removing or restricting access to the snp/snoop.jsp file as a temporary workaround. For Apache Tomcat versions 6.0.0 through 6.0.13, apply configuration changes to prevent injection of arbitrary web script or HTML via the URI.

Exploit

Fix

Related Identifiers

CVE-2007-2449

GHSA-HC39-RJWP-QFFQ

HPSBUX02262

RHSA-2007:0569

RHSA-2007:0876

RHSA-2007_0569

RHSA-2008:0261

RHSA-2008:0524

RHSA-2008:0630

Affected Products

Apache Tomcat

Hp-Ux

Red Hat

References · 77

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/apache_modjk_overflow.rb · Exploit
• 🔥 https://exploit-db.com/exploits/30189 · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00008.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2449 · Security Note
• http://rhn.redhat.com/errata/RHSA-2008-0630.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3386 · Security Note
• https://redhat.com/archives/fedora-package-announce/2007-November/msg00525.html · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0569.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0774 · Security Note
• http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0261.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2450 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756 · Security Note