{"id":"CVE-2008-1947","published":"2008-06-04T19:17:00Z","modified":"2024-08-07T08:40:59Z","title":"Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote…","vendor":null,"product":null,"tier":"tail","description":{"text":"Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.09776,"percentile":0.95502,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/archive/1/492958/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://secunia.com/advisories/30500","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0862.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://secunia.com/advisories/34013","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://marc.info/?l=tomcat-user&m=121244319501278&w=2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6009","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"http://www.vupen.com/english/advisories/2008/2823","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42816","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://secunia.com/advisories/37460","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2009-0002.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/31681","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://secunia.com/advisories/32120","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2009-0016.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.vupen.com/english/advisories/2008/1725","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://secunia.com/advisories/30592","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/33999","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11534","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"http://www.securityfocus.com/bid/29502","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://secunia.com/advisories/31865","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00889.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://secunia.com/advisories/31639","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/30967","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:188","tags":["vendor-advisory","x_refsource_MANDRIVA"]},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm","tags":["x_refsource_CONFIRM"]},{"url":"http://www.vupen.com/english/advisories/2009/0320","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.securityfocus.com/archive/1/507985/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0864.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://tomcat.apache.org/security-6.html","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/57126","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/32222","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/31891","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/33797","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securitytracker.com/id?1020624","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00712.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00859.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://tomcat.apache.org/security-5.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.vupen.com/english/advisories/2008/2780","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://marc.info/?l=bugtraq&m=123376588623823&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://marc.info/?l=bugtraq&m=139344343412337&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE"]},{"url":"http://support.apple.com/kb/HT3216","tags":["x_refsource_CONFIRM"]},{"url":"http://www.vupen.com/english/advisories/2009/0503","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.vupen.com/english/advisories/2009/3316","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.debian.org/security/2008/dsa-1593","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://secunia.com/advisories/32266","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0648.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":19.1,"factors":[{"name":"EPSS percentile","points":19.1}]},"referencesTotal":52,"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=5.5.9, <5.5.27",">=6.0.0, <6.0.18"],"patched":["5.5.27","6.0.18"],"from":["GHSA-f98p-9pp6-7q6c"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=5.5.9, <5.5.27",">=6.0.0, <6.0.18"],"patched":["5.5.27","6.0.18"],"from":["GHSA-f98p-9pp6-7q6c"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3733","exploited":false,"provenance":"source"}}