GitHub Advisoryadvisory · Maven
GHSA-3p86-xgrq-m6p6 Improper Neutralization of Input During Web Page Generation in Apache Tomcat
MEDIUM
Official page ↗
- Aliases
- CVE-2011-0013
- Ecosystem
- Maven
- Packages
- org.apache.tomcat:tomcat
- Severity
- Moderate
- Weaknesses
- CWE-79
- Reviewed
- 2022-07-13
Affected packages
• Maven org.apache.tomcat:tomcat: >= 5.5.0, < 5.5.32 → fixed in 5.5.32
• Maven org.apache.tomcat:tomcat: >= 6.0.0, < 6.0.30 → fixed in 6.0.30
• Maven org.apache.tomcat:tomcat: >= 7.0.0, < 7.0.6 → fixed in 7.0.6
Description
Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
Related
Alias · CVE (1)
- CVE-2011-0013 Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30,… vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2011-0013 advisory
- https://github.com/apache/tomcat/commit/58223c5ecc0751c3642c810f291b8f033d33b97f web
- https://github.com/apache/tomcat55/commit/863d77c7d321245de019ac32252828e0a025c5b4 web
- https://web.archive.org/web/20151017023138/http://secunia.com/advisories/57126 web
- https://web.archive.org/web/20120213130147/http://www.securityfocus.com/bid/46174 web
- https://web.archive.org/web/20120126070320/http://www.securitytracker.com/id?1025026 web
- https://web.archive.org/web/20120126065143/http://www.securityfocus.com/archive/1/516209/30/90/threaded web
- https://web.archive.org/web/20111229163935/http://secunia.com/advisories/43192 web
- https://web.archive.org/web/20111227000129/http://secunia.com/advisories/45022 web
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19269 web
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14945 web
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12878 web
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E web
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E web
- https://github.com/apache/tomcat package
- https://bugzilla.redhat.com/show_bug.cgi?id=675786 web
- https://access.redhat.com/security/cve/CVE-2011-0013 web
- https://access.redhat.com/errata/RHSA-2011:1845 web
- https://access.redhat.com/errata/RHSA-2011:0897 web
- https://access.redhat.com/errata/RHSA-2011:0896 web
- https://access.redhat.com/errata/RHSA-2011:0791 web
- http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html web
- http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html web
- http://marc.info/?l=bugtraq&m=130168502603566&w=2 web
- http://marc.info/?l=bugtraq&m=132215163318824&w=2 web
- http://marc.info/?l=bugtraq&m=136485229118404&w=2 web
- http://marc.info/?l=bugtraq&m=139344343412337&w=2 web
- http://securityreason.com/securityalert/8093 web
- http://support.apple.com/kb/HT5002 web
- http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html web
- http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.32 web
- http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.30 web
- http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.6_%28released_14_Jan_2011%29 web
- http://www.debian.org/security/2011/dsa-2160 web
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:030 web