GitHub Advisoryadvisory · Maven

GHSA-4c6x-gfc8-c26r Apache Tomcat Vulnerable to Cross-Site Scripting

MEDIUM Published 2022-05-01 Modified 2025-04-09 Official page ↗
Aliases
CVE-2007-1355
Ecosystem
Maven
Packages
org.apache.tomcat:jsp-api, org.apache.tomcat:servlet-api
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-79
Reviewed
2025-04-09

Affected packages

• Maven org.apache.tomcat:jsp-api: >= 4.1.0, < 4.1.37 → fixed in 4.1.37 • Maven org.apache.tomcat:jsp-api: >= 5.5.0, < 5.5.24 → fixed in 5.5.24 • Maven org.apache.tomcat:jsp-api: >= 6.0.0, < 6.0.11 → fixed in 6.0.11 • Maven org.apache.tomcat:jsp-api: >= 5.0.0, <= 5.0.30 (no fix yet) • Maven org.apache.tomcat:jsp-api: >= 4.0.0, <= 4.0.6 (no fix yet) • Maven org.apache.tomcat:servlet-api: >= 4.1.0, < 4.1.37 → fixed in 4.1.37 • Maven org.apache.tomcat:servlet-api: >= 5.5.0, < 5.5.24 → fixed in 5.5.24 • Maven org.apache.tomcat:servlet-api: >= 6.0.0, < 6.0.11 → fixed in 6.0.11 • Maven org.apache.tomcat:servlet-api: >= 5.0.0, <= 5.0.30 (no fix yet) • Maven org.apache.tomcat:servlet-api: >= 4.0.0, <= 4.0.6 (no fix yet)

Description

Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2007-1355 Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6,… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References