Veracode Vulnerability DatabaseVERACODE:13510Cross-Site Scripting (XSS)
0.959 High
EPSS
Percentile
99.5%
Apache Tomcat is vulnerable to cross-site scripting (XSS). A remote attacker is able to inject arbitrary Javascript into a victim’s browser via the time parameter in cal2.jsp to steal session tokens or perform unwanted actions on behalf of the user.
References
community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
osvdb.org/34888
secunia.com/advisories/29242
secunia.com/advisories/33668
support.avaya.com/elmodocs2/security/ASA-2007-206.htm
support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
tomcat.apache.org/security-4.html
tomcat.apache.org/security-5.html
www.redhat.com/support/errata/RHSA-2008-0261.html
www.securityfocus.com/archive/1/478491/100/0/threaded
www.securityfocus.com/archive/1/478609/100/0/threaded
www.securityfocus.com/archive/1/500396/100/0/threaded
www.securityfocus.com/archive/1/500412/100/0/threaded
www.securityfocus.com/bid/25531
www.vupen.com/english/advisories/2007/1729
www.vupen.com/english/advisories/2009/0233
access.redhat.com/errata/RHSA-2007:0326
access.redhat.com/errata/RHSA-2007:0340
access.redhat.com/errata/RHSA-2008:0261
access.redhat.com/errata/RHSA-2008:0524
access.redhat.com/security/cve/CVE-2006-7196
bugzilla.redhat.com/show_bug.cgi?id=238131
lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
Related
