Lucene search

GoogleOSV:GHSA-G77G-VJJM-X83J

HistoryMay 01, 2022 - 6:26 p.m.

Apache Tomcat Example Application CSRF and XSS Vulnerabilities

2022-05-0118:26:30

Google

osv.dev

apache tomcat 4.1.31

example application

csrf

xss

calendar examples

remote attackers

arbitrary users

time parameter

description parameter

security vulnerabilities

AI Score

7.3

Confidence

High

EPSS

0.009

Percentile

82.3%

JSON

Cross-site request forgery (CSRF) vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters.

References

nvd.nist.gov/vuln/detail/CVE-2007-4724

web.archive.org/web/20070911063436/securityreason.com/securityalert/3094

web.archive.org/web/20081006123851/archives.neohapsis.com/archives/bugtraq/2007-09/0040.html

web.archive.org/web/20200526022330/www.securityfocus.com/archive/1/478491/100/0/threaded