CVE-2010-4172

Apache Tomcat < 7.0.5 - XSS

Title source: rule
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Adam Muntner · textremotelinux
https://www.exploit-db.com/exploits/35011

References (24)

Core 24
Core References
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1048-1
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/42337
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/514866/100/0/threaded
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/45022
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/63422
Patch, Vendor Advisory x_refsource_confirm
http://tomcat.apache.org/security-7.html
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=656246
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/3047
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
Third Party Advisory mailing-list x_refsource_fulldisc
http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0285.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-0897.html
Various Sources x_refsource_confirm
http://tomcat.apache.org/security-6.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/57126
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-0791.html
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0203
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1024764
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-0896.html
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT5002
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=139344343412337&w=2
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43019
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/45015

Scores

EPSS 0.1190
EPSS Percentile 93.8%

Details

CWE
CWE-79
Status published
Products (20)
apache/tomcat 6.0.12
apache/tomcat 6.0.13
apache/tomcat 6.0.14
apache/tomcat 6.0.15
apache/tomcat 6.0.16
apache/tomcat 6.0.17
apache/tomcat 6.0.18
apache/tomcat 6.0.19
apache/tomcat 6.0.20
apache/tomcat 6.0.24
... and 10 more
Published Nov 26, 2010
Tracked Since Feb 18, 2026