CVE-2010-4172

Improper Neutralization of Input During Web Page Generation in Apache Tomcat

Title source: GitHub Advisory
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2010-4172 has a selected CVSS score of 4.3; EIP currently links 1 catalogued exploit.

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Affected products and versions

1
ProductSourceVersion range

org.apache.tomcat:tomcat

Browse Maven / org.apache.tomcat:tomcat
GitHub Advisory7.0.0 to < 7.0.5 · Fixed in 7.0.5affected
6.0.12 to ≤ 6.0.29affected

Proofs of concept

1

Catalogued exploits

ExploitDBApache Tomcat 7.0.4 - 'sort' / 'orderBy' Cross-Site ScriptingExploitDB exploitby Adam MuntnerNot analyzed1 file
ExploitDB
PoC details

References

Showing 12 of 36