CVE-2007-2450

Loading...

General

Score:3.5/10.0
Severity:Low
Category:XSS Injection
Exploit:Available

Impact Metrics

Confidentiality:None
Integrity:Partial
Availability:None

Exploitability Metrics

Access Vector:Network
Access Complexity:Medium
Authentication:Multiple

Relative vulnerabilities

CVE-2002-1148, CVE-2002-1394, CVE-2002-2006, CVE-2003-0866, CVE-2004-0687, CVE-2004-0688, CVE-2004-0885, CVE-2004-0914, CVE-2005-0605, CVE-2005-2090, CVE-2005-3164, CVE-2005-3510, CVE-2005-3964, CVE-2005-4838, CVE-2006-0254, CVE-2006-0898, CVE-2006-1329, CVE-2006-3835, CVE-2006-5752, CVE-2006-7195, CVE-2006-7196, CVE-2006-7197, CVE-2007-0243, CVE-2007-0450, CVE-2007-1349, CVE-2007-1355, CVE-2007-1358, CVE-2007-1858, CVE-2007-1860, CVE-2007-2435, CVE-2007-2449, CVE-2007-2788, CVE-2007-2789, CVE-2007-3304, CVE-2007-3382, CVE-2007-3383, CVE-2007-3385, CVE-2007-4465, CVE-2007-5000, CVE-2007-5333, CVE-2007-5461, CVE-2007-5961, CVE-2007-6276, CVE-2007-6306, CVE-2007-6388, CVE-2008-0128, CVE-2008-0960, CVE-2008-1105, CVE-2008-1145, CVE-2008-1232, CVE-2008-2307, CVE-2008-2308, CVE-2008-2309, CVE-2008-2310, CVE-2008-2311, CVE-2008-2313, CVE-2008-2314, CVE-2008-2370, CVE-2008-2662, CVE-2008-2663, CVE-2008-2664, CVE-2008-2725, CVE-2008-2726, CVE-2008-2938

Published on 15/06/07 - Updated on 25/03/19

Description

Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.

Category: XSS Injection

CWE-79 (Cross-Site Scripting (XSS))
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Security Notices

US National Vulnerability DatabaseCVE-2007-2450
Agence Nationale de la Sécurité des Systèmes d'Information CERTA-2007-AVI-267, CERTA-2007-AVI-362, CERTA-2008-AVI-343, CERTA-2008-AVI-349, CERTA-2009-AVI-032
Redhat RHSA-2008:0261, RHSA-2008:0524
Renater 2008/VULN259, 2008/VULN260, 2010/VULN248

Exploits

SecurityFocusBID-24475

Relative technologies

VendorProduct
apachetomcat

Share this vulnerability with:

Twitter Facebook LinkedIn Mail