CVE-2010-4172

Apache Tomcat 6.0.12-6.0.29 and 7.0.0-7.0.4 - Cross-Site Scripting via Manager Application Parameters

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-4172. PoCs published by Adam Muntner.

AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in Apache Tomcat, where user-supplied input is not properly sanitized. It includes a sample URL demonstrating the vulnerability but lacks executable exploit code.

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Adam Muntner · textremotelinux
https://www.exploit-db.com/exploits/35011

The provided text describes a cross-site scripting (XSS) vulnerability in Apache Tomcat, where user-supplied input is not properly sanitized. It includes a sample URL demonstrating the vulnerability but lacks executable exploit code.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: Apache Tomcat (version not specified)
No auth needed
Prerequisites: A vulnerable version of Apache Tomcat · User interaction to trigger the XSS payload
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (24)

Core 24
Core References
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1048-1
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/42337
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/514866/100/0/threaded
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/45022
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/63422
Patch, Vendor Advisory x_refsource_confirm
http://tomcat.apache.org/security-7.html
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=656246
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/3047
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
Third Party Advisory mailing-list x_refsource_fulldisc
http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0285.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-0897.html
Various Sources x_refsource_confirm
http://tomcat.apache.org/security-6.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/57126
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-0791.html
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0203
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1024764
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-0896.html
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT5002
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=139344343412337&w=2
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43019
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/45015

Scores

EPSS 0.4201
EPSS Percentile 98.5%

Details

CWE
CWE-79
Status published
Products (20)
apache/tomcat 6.0.12
apache/tomcat 6.0.13
apache/tomcat 6.0.14
apache/tomcat 6.0.15
apache/tomcat 6.0.16
apache/tomcat 6.0.17
apache/tomcat 6.0.18
apache/tomcat 6.0.19
apache/tomcat 6.0.20
apache/tomcat 6.0.24
... and 10 more
Published Nov 26, 2010
Tracked Since Feb 18, 2026