PT-2009-3392 · Apache+2 · Apache Tomcat+2

Published 2009-03-09 · Updated 2023-02-13 · CVE-2009-0781

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 4.1.0 through 4.1.39 Apache Tomcat versions 5.5.0 through 5.5.27 Apache Tomcat versions 6.0.0 through 6.0.18

Description The issue is related to a cross-site scripting (XSS) flaw in the calendar application, specifically in the jsp/cal/cal2.jsp file. This flaw is caused by invalid HTML, which makes the XSS filtering protection ineffective. Remote attackers can inject arbitrary web script or HTML via the time parameter.

Recommendations For Apache Tomcat versions 4.1.0 through 4.1.39, update to a version outside of this range to resolve the issue. For Apache Tomcat versions 5.5.0 through 5.5.27, update to a version outside of this range to resolve the issue. For Apache Tomcat versions 6.0.0 through 6.0.18, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the calendar application in the examples web application until a patch is available. Avoid using the time parameter in the affected jsp/cal/cal2.jsp file until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-0781

DSA-2207-1

GHSA-J788-FX57-99WP

HPSBUX02579

HPSBUX02860

RHSA-2009:1164

RHSA-2009:1562

RHSA-2009_1164

Affected Products

Apache Tomcat

Hp-Ux

Red Hat

References · 101

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/hashcollision_dos.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_enum.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/slowloris.py · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/apache_tomcat_transfer_encoding.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/tomcat_mgr_login.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb · Exploit
• http://marc.info/?l=bugtraq&m=133469267822771&w=2 · Vendor Advisory
• http://debian.org/security/2011/dsa-2207 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0781 · Security Note
• http://tomcat.apache.org/security-4.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3718 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-November/msg01246.html · Vendor Advisory
• https://debian.org/security/2011/dsa-2207 · Vendor Advisory