CVE-2007-1358

Apache Tomcat < 4.1.31 - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

References (38)

... and 18 more

Scores

EPSS 0.3986
EPSS Percentile 97.3%

Classification

CWE
CWE-79
Status draft

Affected Products (10)

apache/tomcat < 4.1.31
apache/tomcat
apache/tomcat
apache/tomcat
apache/tomcat
apache/tomcat
apache/tomcat
apache/tomcat
apache/tomcat
org.apache.tomcat/tomcat Maven

Timeline

Published May 10, 2007
Tracked Since Feb 18, 2026