4.3

CVE-2007-3386

Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Tomcat Version5.5.0
Apache ≫ Tomcat Version5.5.1
Apache ≫ Tomcat Version5.5.2
Apache ≫ Tomcat Version5.5.3
Apache ≫ Tomcat Version5.5.4
Apache ≫ Tomcat Version5.5.5
Apache ≫ Tomcat Version5.5.6
Apache ≫ Tomcat Version5.5.7
Apache ≫ Tomcat Version5.5.8
Apache ≫ Tomcat Version5.5.9
Apache ≫ Tomcat Version5.5.10
Apache ≫ Tomcat Version5.5.11
Apache ≫ Tomcat Version5.5.12
Apache ≫ Tomcat Version5.5.13
Apache ≫ Tomcat Version5.5.14
Apache ≫ Tomcat Version5.5.15
Apache ≫ Tomcat Version5.5.16
Apache ≫ Tomcat Version5.5.17
Apache ≫ Tomcat Version5.5.18
Apache ≫ Tomcat Version5.5.19
Apache ≫ Tomcat Version5.5.20
Apache ≫ Tomcat Version5.5.21
Apache ≫ Tomcat Version5.5.22
Apache ≫ Tomcat Version5.5.23
Apache ≫ Tomcat Version5.5.24
Apache ≫ Tomcat Version6.0.0
Apache ≫ Tomcat Version6.0.1
Apache ≫ Tomcat Version6.0.2
Apache ≫ Tomcat Version6.0.3
Apache ≫ Tomcat Version6.0.4
Apache ≫ Tomcat Version6.0.5
Apache ≫ Tomcat Version6.0.6
Apache ≫ Tomcat Version6.0.7
Apache ≫ Tomcat Version6.0.8
Apache ≫ Tomcat Version6.0.9
Apache ≫ Tomcat Version6.0.10
Apache ≫ Tomcat Version6.0.11
Apache ≫ Tomcat Version6.0.12
Apache ≫ Tomcat Version6.0.13
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 58.96% 0.99
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
http://secunia.com/advisories/27037
http://secunia.com/advisories/33668
http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
http://tomcat.apache.org/security-6.html
Patch
http://www.securityfocus.com/archive/1/500396/100/0/threaded
http://www.securityfocus.com/archive/1/500412/100/0/threaded
http://www.vupen.com/english/advisories/2007/3386
http://www.vupen.com/english/advisories/2009/0233
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
http://www.mandriva.com/security/advisories?name=MDKSA-2007:241
http://secunia.com/advisories/27727
https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554
http://secunia.com/advisories/26898
http://secunia.com/advisories/27267
http://secunia.com/advisories/28317
http://www.debian.org/security/2008/dsa-1447
http://www.redhat.com/support/errata/RHSA-2007-0871.html
http://www.vupen.com/english/advisories/2007/3527
http://jvn.jp/jp/JVN%2359851336/index.html
http://osvdb.org/36417
http://secunia.com/advisories/26465
http://securityreason.com/securityalert/3010
http://securitytracker.com/id?1018558
http://www.securityfocus.com/archive/1/476448/100/0/threaded
http://www.securityfocus.com/bid/25314
http://www.vupen.com/english/advisories/2007/2880
https://exchange.xforce.ibmcloud.com/vulnerabilities/36001
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10077