GitHub Advisoryadvisory · Maven

GHSA-xmc9-6p56-3c4v Apache Tomcat XSS In Accept-Language Headers

LOW Published 2022-05-01 Modified 2023-09-22 Official page ↗
Aliases
CVE-2007-1358
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Low
Weaknesses
CWE-79
Reviewed
2023-09-22

Affected packages

• Maven org.apache.tomcat:tomcat: >= 4.0.0, <= 4.0.6 (no fix yet) • Maven org.apache.tomcat:tomcat: >= 4.1.0, <= 4.1.34 (no fix yet)

Description

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

Related

Alias · CVE (1)

  • CVE-2007-1358 Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References