CVE-2007-2450

Apache Tomcat 4.0.0-4.0.6, 4.1.0-4.1.36, 5.0.0-5.0.30, 5.5.0-5.5.24, 6.0.0-6.0.13 - XSS via Manager Upload

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.

References (42)

Core 42

Core References

Patch, Vendor Advisory x_refsource_confirm

http://tomcat.apache.org/security-4.html

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/30908

Vendor Advisory x_refsource_confirm

http://support.apple.com/kb/HT2163

Vendor Advisory vendor-advisory x_refsource_sunalert

http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/36079

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/1981/references

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/30899

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11287

Vendor Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/1979/references

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2007-0569.html

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/500412/100/0/threaded

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1018245

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/33668

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/500396/100/0/threaded

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/28549

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/471357/100/0/threaded

Mailing List vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2009/0233

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/25678

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html

Patch, Vendor Advisory x_refsource_confirm

http://tomcat.apache.org/security-6.html

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2007/3386

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/30802

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/27037

Vendor Advisory vendor-advisory x_refsource_hp

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/27727

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/24475

Patch, Vendor Advisory x_refsource_confirm

http://tomcat.apache.org/security-5.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/34868

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2008/dsa-1468

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2008-0261.html

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26076

Third Party Advisory third-party-advisory x_refsource_jvn

http://jvn.jp/jp/JVN%2307100457/index.html

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2007/2213

Various Sources x_refsource_confirm

http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx

Various Sources x_refsource_confirm

http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDKSA-2007:241

Third Party Advisory third-party-advisory x_refsource_sreason

http://securityreason.com/securityalert/2813

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E

Scores

EPSS 0.0329

EPSS Percentile 87.1%

Details

CWE

CWE-79

Status published

Products (49)

apache/tomcat 4.0.0

apache/tomcat 4.0.1

apache/tomcat 4.0.2

apache/tomcat 4.0.3

apache/tomcat 4.0.4

apache/tomcat 4.0.5

apache/tomcat 4.0.6

apache/tomcat 4.1.0

apache/tomcat 4.1.1

apache/tomcat 4.1.2

... and 39 more

Published Jun 14, 2007

Tracked Since Feb 18, 2026