PT-2007-5880 · Apache · Apache Tomcat

Tushar Vartak · Published 2007-09-05 · Updated 2022-05-01 · CVE-2007-4724

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Apache Tomcat version 4.1.31

Description: A cross-site request forgery issue exists in the calendar examples application, specifically in cal2.jsp. This allows remote attackers to add events as arbitrary users by manipulating the time and description parameters.

Recommendations: For Apache Tomcat version 4.1.31, as a temporary workaround, consider restricting access to the cal2.jsp page in the calendar examples application until a patch is available. Avoid using the time and description parameters in the affected page until the issue is resolved.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2007-4724

GHSA-G77G-VJJM-X83J

Affected Products

Apache Tomcat

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2007-4724 · Security Note
• https://osv.dev/vulnerability/GHSA-g77g-vjjm-x83j · Vendor Advisory
• https://web.archive.org/web/20081006123851/http://archives.neohapsis.com/archives/bugtraq/2007-09/0040.html · Note
• http://archives.neohapsis.com/archives/bugtraq/2007-09/0040.html · Note
• http://osvdb.org/41029 · Note
• http://securityfocus.com/archive/1/478491/100/0/threaded · Note
• https://web.archive.org/web/20070911063436/http://securityreason.com/securityalert/3094 · Note
• https://web.archive.org/web/20200526022330/http://securityfocus.com/archive/1/478491/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4724 · Note
• http://securityreason.com/securityalert/3094 · Note