PT-2007-4661 · Apache+2 · Apache Tomcat+2

Published 2007-08-13 · Updated 2018-10-16 · CVE-2007-3386

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.0 through 5.5.24 Apache Tomcat versions 6.0.0 through 6.0.13

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary HTML and web script via crafted requests. This is possible because the Host Manager Servlet does not filter user-supplied data before display, enabling an XSS attack. For example, an attack can be demonstrated using the aliases parameter to an "html/add" action.

Recommendations For Apache Tomcat versions 5.5.0 through 5.5.24, update to a version that includes the fix for this issue. For Apache Tomcat versions 6.0.0 through 6.0.13, update to a version that includes the fix for this issue. As a temporary workaround, consider filtering user-supplied data in the Host Manager Servlet to prevent XSS attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-3386

DSA-1447-1

HPSBUX02262

RHSA-2007:0871

RHSA-2007:0876

RHSA-2007_0871

Affected Products

Apache Tomcat

Hp-Ux

Red Hat

References · 62

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/apache_modjk_overflow.rb · Exploit
• 🔥 https://exploit-db.com/exploits/30495 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2872 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1887 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0774 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1900 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3385 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2007:241 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3386 · Security Note
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3386 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0450 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1860 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2450 · Security Note