{"id":"CVE-2006-7195","published":"2007-05-09T22:00:00Z","modified":"2024-08-07T20:57:40Z","title":"Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0…","vendor":null,"product":null,"tier":"tail","description":{"text":"Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.05476,"percentile":0.92731,"provenance":"source"},"cwes":[],"references":[{"url":"http://lists.vmware.com/pipermail/security-announce/2008/000003.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.securityfocus.com/bid/28481","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.vupen.com/english/advisories/2008/0065","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.securityfocus.com/archive/1/500412/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://secunia.com/advisories/33668","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securityfocus.com/archive/1/485938/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://www.securityfocus.com/archive/1/500396/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://www.vupen.com/english/advisories/2007/1729","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.vupen.com/english/advisories/2009/0233","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://secunia.com/advisories/28365","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm","tags":["x_refsource_CONFIRM"]},{"url":"http://www.redhat.com/support/errata/RHSA-2007-0327.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://tomcat.apache.org/security-5.html","tags":["x_refsource_CONFIRM"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10514","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0261.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx","tags":["x_refsource_CONFIRM"]},{"url":"http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.5,"factors":[{"name":"EPSS percentile","points":18.55}]},"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=5.0.0, <=5.0.30",">=5.5.0, <5.5.18"],"patched":["5.5.18"],"from":["GHSA-p57v-p3fx-qgwm"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4681","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2005-3510","published":"2005-11-06","fixed":"5.5.12","kev":false},{"cve":"CVE-2006-7196","published":"2007-05-09","fixed":"5.5.16","kev":false},{"cve":"CVE-2006-3835","published":"2006-07-25","fixed":"5.5.17","kev":false,"link":{"from":"CVE-2006-3835","to":"CVE-2006-7195","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"5.5.17","toFixed":"5.5.18","daysApart":288}]}},{"cve":"CVE-2006-7195","published":"2007-05-09","fixed":"5.5.18","kev":false},{"cve":"CVE-2008-4308","published":"2009-02-26","fixed":"5.5.21","kev":false,"link":{"from":"CVE-2006-7195","to":"CVE-2008-4308","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"5.5.18","toFixed":"5.5.21","daysApart":659}]}},{"cve":"CVE-2007-0450","published":"2007-03-16","fixed":"6.0.10","kev":false},{"cve":"CVE-2007-2450","published":"2007-06-14","fixed":"6.0.14","kev":false}],"package":"Maven:org.apache.tomcat:tomcat"}}