CVE-2007-3386 | BDVDB-2026-25816 Detail
Description#
Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://osvdb.org/36417
- https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html
- http://secunia.com/advisories/27267
- http://www.vupen.com/english/advisories/2007/3527
- http://jvn.jp/jp/JVN%2359851336/index.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36001
- http://www.securityfocus.com/bid/25314
- http://secunia.com/advisories/26465
- http://www.securityfocus.com/archive/1/500412/100/0/threaded
- http://secunia.com/advisories/33668
- http://www.securityfocus.com/archive/1/500396/100/0/threaded
- http://secunia.com/advisories/26898
- http://securitytracker.com/id?1018558
- http://securityreason.com/securityalert/3010
- http://www.vupen.com/english/advisories/2007/2880
Show all 31
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554
- http://secunia.com/advisories/28317
- http://www.vupen.com/english/advisories/2009/0233
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
- http://tomcat.apache.org/security-6.html
- http://www.redhat.com/support/errata/RHSA-2007-0871.html
- http://www.vupen.com/english/advisories/2007/3386
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10077
- http://www.securityfocus.com/archive/1/476448/100/0/threaded
- http://secunia.com/advisories/27037
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
- http://secunia.com/advisories/27727
- http://www.debian.org/security/2008/dsa-1447
- http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
- http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:241
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.