Vulnerability CVE-2007-2450


Published: 2007-06-14   Modified: 2012-02-12

Description:
Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.

See advisories in our WLB2 database:
Topic
Author
Date
Low
Apache Tomcat XSS vulnerability in Manager
Mark Thomas
22.06.2007

Type:

CWE-79

(Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

Vendor: Apache
Product: Tomcat 
Version:
6.0.9
6.0.8
6.0.7
6.0.6
6.0.5
6.0.4
6.0.3
6.0.2
6.0.13
6.0.12
6.0.11
6.0.10
6.0.1
6.0.0
5.5.9
5.5.8
5.5.7
5.5.6
5.5.5
5.5.4
5.5.3
5.5.24
5.5.23
5.5.22
5.5.21
5.5.20
5.5.2
5.5.19
5.5.18
5.5.17
5.5.16
5.5.15
5.5.14
5.5.13
5.5.12
5.5.11
5.5.10
5.5.1
5.5.0
5.0.9
5.0.8
5.0.7
5.0.6
5.0.5
5.0.4
5.0.30
5.0.3
5.0.29
5.0.28
5.0.27
5.0.26
5.0.25
5.0.24
5.0.23
5.0.22
5.0.21
5.0.2
5.0.19
5.0.18
5.0.17
5.0.16
5.0.15
5.0.14
5.0.13
5.0.12
5.0.11
5.0.10
5.0.1
5.0.0
4.1.9
4.1.36
4.1.31
4.1.3
4.1.28
4.1.24
4.1.2
4.1.15
4.1.10
4.1.1
4.1.0
4.0.6
4.0.5
4.0.4
4.0.3
4.0.2
4.0.1
4.0.0

CVSS2 => (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.5/10
2.9/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None

 References:
http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
http://jvn.jp/jp/JVN%2307100457/index.html
http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
http://securityreason.com/securityalert/2813
http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1
http://support.apple.com/kb/HT2163
http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
http://tomcat.apache.org/security-4.html
http://tomcat.apache.org/security-5.html
http://tomcat.apache.org/security-6.html
http://www.debian.org/security/2008/dsa-1468
http://www.mandriva.com/security/advisories?name=MDKSA-2007:241
http://www.redhat.com/support/errata/RHSA-2007-0569.html
http://www.redhat.com/support/errata/RHSA-2008-0261.html
http://www.securityfocus.com/archive/1/471357/100/0/threaded
http://www.securityfocus.com/archive/1/500396/100/0/threaded
http://www.securityfocus.com/archive/1/500412/100/0/threaded
http://www.securityfocus.com/bid/24475
http://www.securitytracker.com/id?1018245
http://www.vupen.com/english/advisories/2007/2213
http://www.vupen.com/english/advisories/2007/3386
http://www.vupen.com/english/advisories/2008/1979/references
http://www.vupen.com/english/advisories/2008/1981/references
http://www.vupen.com/english/advisories/2009/0233
https://exchange.xforce.ibmcloud.com/vulnerabilities/34868
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11287
https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html

Related CVE
CVE-2018-20242
A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking.
CVE-2018-1340
Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, which could allow an attacker eavesdropping on the network to intercept the user's session token if unencrypted ...
CVE-2018-1296
In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to t...
CVE-2018-11803
Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will crash after dereferencing an uninitialized pointer if the client omits the root path in a recursive directory listing operation.
CVE-2018-11760
When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.
CVE-2018-11790
When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs. In this case OpenOffice runs into an Arithmetic Overflow at a string length calculation.
CVE-2019-0190
A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server ve...
CVE-2018-17199
In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session...

Copyright 2019, cxsecurity.com

 

Back to Top