CVE-2007-3386
NoneCVSS
—
EPSS
59.0%
Published
Aug 14, 2007
CISA due date
—
The record
Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:4.0 | tomcat5.5 | 0 | 5.5.20-2etch1 |
| Red Hat:enterprise_linux:5::client | tomcat5 | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client | tomcat5-admin-webapps | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client | tomcat5-common-lib | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client | tomcat5-debuginfo | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client | tomcat5-jasper | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client | tomcat5-jasper-javadoc | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client | tomcat5-server-lib | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client | tomcat5-webapps | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5 | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-admin-webapps | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-common-lib | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-debuginfo | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-jasper | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-jasper-javadoc | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-server-lib | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-webapps | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::server | tomcat5 | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::server | tomcat5-admin-webapps | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::server | tomcat5-common-lib | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::server | tomcat5-debuginfo | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::server | tomcat5-jasper | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::server | tomcat5-jasper-javadoc | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::server | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::server | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::server | tomcat5-server-lib | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::server | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::server | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:enterprise_linux:5::server | tomcat5-webapps | 0 | 0:5.5.23-0jpp.3.0.2.el5 |
| Red Hat:rhel_application_server:2 | tomcat5 | 0 | 0:5.5.23-0jpp_4rh.4 |
| Red Hat:rhel_application_server:2 | tomcat5-admin-webapps | 0 | 0:5.5.23-0jpp_4rh.4 |
| Red Hat:rhel_application_server:2 | tomcat5-common-lib | 0 | 0:5.5.23-0jpp_4rh.4 |
| Red Hat:rhel_application_server:2 | tomcat5-jasper | 0 | 0:5.5.23-0jpp_4rh.4 |
| Red Hat:rhel_application_server:2 | tomcat5-jasper-javadoc | 0 | 0:5.5.23-0jpp_4rh.4 |
| Red Hat:rhel_application_server:2 | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp_4rh.4 |
| Red Hat:rhel_application_server:2 | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.23-0jpp_4rh.4 |
| Red Hat:rhel_application_server:2 | tomcat5-server-lib | 0 | 0:5.5.23-0jpp_4rh.4 |
| Red Hat:rhel_application_server:2 | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp_4rh.4 |
| Red Hat:rhel_application_server:2 | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.23-0jpp_4rh.4 |
| Red Hat:rhel_application_server:2 | tomcat5-webapps | 0 | 0:5.5.23-0jpp_4rh.4 |
Related vulnerabilities
- CVE-2008-0128 The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat… Also affects tomcat5.5
- CVE-2007-5461 Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0… Also affects tomcat5.5
- CVE-2007-3385 Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3… Also affects tomcat5.5
- CVE-2007-3382 Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3… Also affects tomcat5.5
- CVE-2012-0022 Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an… Also affects tomcat5
- CVE-2011-4858 Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash… Also affects tomcat5
- CVE-2011-0013 Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in… Also affects tomcat5
- CVE-2010-2227 Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not… Also affects tomcat5