GitHub Advisoryadvisory · Maven

GHSA-j788-fx57-99wp Cross-site scripting in Apache Tomcat

MEDIUM Published 2022-05-02 Modified 2022-06-17 Official page ↗
Aliases
CVE-2009-0781
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2022-06-17

Affected packages

• Maven org.apache.tomcat:tomcat: >= 4.1.0, <= 4.1.39 (no fix yet) • Maven org.apache.tomcat:tomcat: >= 5.5.0, <= 5.5.27 (no fix yet) • Maven org.apache.tomcat:tomcat: >= 6.0.0, < 6.0.20 → fixed in 6.0.20

Description

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML."

Related

Alias · CVE (1)

  • CVE-2009-0781 Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References