GHSA-f98p-9pp6-7q6c

Apache Tomcat Cross-site scripting (XSS) vulnerability

En bref

Publiée: 2022-05-01 23:45 UTC
Mise à jour: 2025-04-09 16:44 UTC
CVE: CVE-2008-1947
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Description

Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to `host-manager/html/add`.

Paquets affectés

Paquet	Versions
Maven · org.apache.tomcat:tomcat	introduced 5.5.9, fixed 5.5.27
Maven · org.apache.tomcat:tomcat	introduced 6.0.0, fixed 6.0.18
Maven · org.apache.tomcat.embed:tomcat-embed-core	introduced 5.5.9, fixed 5.5.27
Maven · org.apache.tomcat.embed:tomcat-embed-core	introduced 6.0.0, fixed 6.0.18

Références

https://nvd.nist.gov/vuln/detail/CVE-2008-1947 ADVISORY
https://github.com/apache/tomcat/commit/ab6a6c41ac972c845717c9d639f0335865afab4d WEB
https://github.com/apache/tomcat/commit/78ad0fcbe29c824f1f2e45a4e2716247b033250a WEB
https://github.com/apache/tomcat/commit/49c71fc59c1b8f8da77aea9eb53e61db168aebab WEB
https://github.com/apache/tomcat/commit/5f00d434c8dc11bd49ce0b4b56fe889839056030 WEB
https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E WEB
https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E WEB
https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E WEB
https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E WEB
https://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html WEB
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11534 WEB
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6009 WEB
https://web.archive.org/web/20200514224656/http://www.securityfocus.com/archive/1/507985/100/0/threaded WEB
https://web.archive.org/web/20201208011750/http://www.securityfocus.com/archive/1/492958/100/0/threaded WEB
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00712.html WEB
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00859.html WEB
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00889.html WEB
https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E WEB
https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E WEB
https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E WEB
https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E WEB
https://github.com/apache/tomcat PACKAGE
https://exchange.xforce.ibmcloud.com/vulnerabilities/42816 WEB
https://bugzilla.redhat.com/show_bug.cgi?id=446393 WEB
https://access.redhat.com/security/cve/CVE-2008-1947 WEB
https://access.redhat.com/errata/RHSA-2008:1007 WEB
https://access.redhat.com/errata/RHSA-2008:0864 WEB
https://access.redhat.com/errata/RHSA-2008:0862 WEB
https://access.redhat.com/errata/RHSA-2008:0648 WEB
http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html WEB
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html WEB
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html WEB
http://marc.info/?l=bugtraq&m=123376588623823&w=2 WEB
http://marc.info/?l=bugtraq&m=139344343412337&w=2 WEB
http://marc.info/?l=tomcat-user&m=121244319501278&w=2 WEB
http://support.apple.com/kb/HT3216 WEB
http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm WEB
http://tomcat.apache.org/security-5.html WEB
http://tomcat.apache.org/security-6.html WEB
http://www.debian.org/security/2008/dsa-1593 WEB
http://www.mandriva.com/security/advisories?name=MDVSA-2008:188 WEB
http://www.redhat.com/support/errata/RHSA-2008-0648.html WEB
http://www.redhat.com/support/errata/RHSA-2008-0862.html WEB
http://www.redhat.com/support/errata/RHSA-2008-0864.html WEB
http://www.vmware.com/security/advisories/VMSA-2009-0002.html WEB
http://www.vmware.com/security/advisories/VMSA-2009-0016.html WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database