CVE-2009-2696
Apache Tomcat < 4.1.39 - Cross-Site Scripting via Calendar Application Time Parameter
Title source: llmDescription
Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.
References (4)
Core 4
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=616717
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2010/1986
Vendor Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2010-0580.html
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/40813
Scores
EPSS
0.0501
EPSS Percentile
91.3%
Details
CWE
CWE-79
Status
published
Products (1)
apache/tomcat
< 4.1.39
Published
Aug 05, 2010
Tracked Since
Feb 18, 2026