PT-2007-4658 · Apache · Apache Tomcat

Tomasz Kuczynski · Published 2007-07-25 · Updated 2022-05-01 · CVE-2007-3383

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 4.0.0 through 4.0.6 Apache Tomcat versions 4.1.0 through 4.1.36

Description A cross-site scripting (XSS) issue exists in the SendMailServlet of the examples web application, allowing remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields. This is related to the generation of error messages, which did not properly escape user-provided data.

Recommendations For Apache Tomcat versions 4.0.0 through 4.0.6, consider undeploying the examples web application to mitigate the risk. For Apache Tomcat versions 4.1.0 through 4.1.36, consider undeploying the examples web application to mitigate the risk. As a temporary workaround, consider disabling the SendMailServlet until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2007-3383

GHSA-WJWR-3JCH-479J

Affected Products

Apache Tomcat

References · 23

• http://tomcat.apache.org/security-4.html · Patch
• http://kb.cert.org/vuls/id/862600 · Patch
• http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3383 · Security Note
• http://seclists.org/fulldisclosure/2007/Jul/0448.html · Patch
• https://osv.dev/vulnerability/GHSA-wjwr-3jch-479j · Vendor Advisory
• https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3383 · Note
• http://vupen.com/english/advisories/2007/2618 · Note
• https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E · Note
• http://vupen.com/english/advisories/2008/1981/references · Note
• http://securityfocus.com/archive/1/474413/100/0/threaded · Note
• http://support.apple.com/kb/HT2163 · Note
• https://tomcat.apache.org/security-4 · Note
• https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E · Note