CVE-2007-3386

Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.

Link	Resource
http://tomcat.apache.org/security-6.html	Patch
http://jvn.jp/jp/JVN%2359851336/index.html
https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html
http://www.redhat.com/support/errata/RHSA-2007-0871.html
http://www.securityfocus.com/bid/25314
http://securitytracker.com/id?1018558
http://secunia.com/advisories/26465
http://secunia.com/advisories/26898
http://secunia.com/advisories/27037
http://secunia.com/advisories/27267
http://secunia.com/advisories/27727
http://securityreason.com/securityalert/3010
http://www.debian.org/security/2008/dsa-1447
http://www.mandriva.com/security/advisories?name=MDKSA-2007:241
http://secunia.com/advisories/28317
http://osvdb.org/36417
http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
http://secunia.com/advisories/33668
http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
http://www.vupen.com/english/advisories/2009/0233
http://www.vupen.com/english/advisories/2007/2880
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
http://www.vupen.com/english/advisories/2007/3386
http://www.vupen.com/english/advisories/2007/3527
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554
https://exchange.xforce.ibmcloud.com/vulnerabilities/36001
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10077
http://www.securityfocus.com/archive/1/500412/100/0/threaded
http://www.securityfocus.com/archive/1/500396/100/0/threaded
http://www.securityfocus.com/archive/1/476448/100/0/threaded

Configuration 1

cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:* cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*

---

Published : 2007-08-14 10:17

Updated : 2018-10-16 04:48

---

NVD link : CVE-2007-3386

Mitre link : CVE-2007-3386

No products.

CWE-79