AOH :: HP Unsorted T :: TB10972.HTM

Tomcat documentation XSS vulnerabilities



Tomcat documentation XSS vulnerabilities
Tomcat documentation XSS vulnerabilities



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2007-1355: Tomcat documentation XSS vulnerabilities

Severity:
Moderate (Cross-site scripting)

Vendor:
The Apache Software Foundation

Versions Affected:
Tomcat 4.0.0 to 4.0.6
Tomcat 4.1.0 to 4.1.36
Tomcat 5.0.0 to 5.0.30
Tomcat 5.5.0 to 5.5.23
Tomcat 6.0.0 to 6.0.10

Description:
The Tomcat documentation web application includes a sample application
that contains multiple XSS vulnerabilities.

Mitigation:
Undeploy the Tomcat documentation web application.

Credit:
These issues were discovered by Ferruh Mavituna.

Example:
http://server/tomcat-docs/appdev/sample/web/hello.jsp?test= 


References:
http://tomcat.apache.org/security.html 

Mark Thomas
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org 

iD8DBQFGTxLXb7IeiTPGAkMRAhPzAKDxibK3Cn9Dq+2ZrlhZszmwPAJufACfdvjv
AH8zWtQXPUbBVgDS+6KoNOE=/6Zd
-----END PGP SIGNATURE-----

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.