CVE-2007-1358

Опубликовано: 10 мая 2007

Источник: nvd

CVSS2: 2.6

EPSS Средний

Описание

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

Ссылки

http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
http://docs.info.apple.com/article.html?artnum=306172
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
http://jvn.jp/jp/JVN%2316535199/index.html
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
http://osvdb.org/34881
http://rhn.redhat.com/errata/RHSA-2008-0630.html
http://secunia.com/advisories/25721
Vendor Advisory
http://secunia.com/advisories/26235
Vendor Advisory
http://secunia.com/advisories/26660
Vendor Advisory
http://secunia.com/advisories/27037
Vendor Advisory
http://secunia.com/advisories/27727
Vendor Advisory
http://secunia.com/advisories/30899
Vendor Advisory
http://secunia.com/advisories/30908
Vendor Advisory
http://secunia.com/advisories/31493
Vendor Advisory
http://secunia.com/advisories/33668
Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1
http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
http://tomcat.apache.org/security-4.html
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Версия до 4.1.31 (включая)

cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:4.0.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:4.0.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*

EPSS

Процентиль: 98%

0.51554

Средний

2.6 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2007-1358

ubuntu

около 18 лет назад

CVE-2007-1358

redhat

около 18 лет назад

CVE-2007-1358

debian

около 18 лет назад

Cross-site scripting (XSS) vulnerability in certain applications using ...

GHSA-xmc9-6p56-3c4v

github

около 3 лет назад

Apache Tomcat XSS In Accept-Language Headers

ELSA-2007-0327

oracle-oval

почти 18 лет назад

ELSA-2007-0327: Important: tomcat security update (IMPORTANT)

EPSS

Процентиль: 98%

0.51554

Средний

2.6 Low

CVSS2

Дефекты

CWE-79