Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2026-50229

Опубликовано: 29 июн. 2026
Источник: redhat
CVSS3: 5.4
EPSS Низкий

Описание

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

A flaw was found in Apache Tomcat. This vulnerability, known as Cross-Site Scripting (XSS), allows a remote attacker to inject malicious scripts into the 'number guess example' web page. When other users view the compromised page, these scripts can execute in their web browsers. This could lead to unauthorized access to sensitive information or allow an attacker to alter the content of the website.

Отчет

A flaw was found in Apache Tomcat. A Cross-Site Scripting (XSS) vulnerability exists in the "number guess" example web application shipped with Tomcat. An attacker can inject malicious scripts into the example page, which execute in other users' browsers when they view the page. This vulnerability only affects the example web application, not the Tomcat servlet container itself. Red Hat Tomcat packages do not deploy example applications by default — they are in separate optional packages (e.g., tomcat-webapps) that are not installed in production environments.

Меры по смягчению последствий

Remove or disable the Tomcat example web applications if they are deployed. Example applications are not needed for production use and should not be accessible in production environments.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 10tomcatFix deferred
Red Hat Enterprise Linux 10tomcat9Fix deferred
Red Hat Enterprise Linux 6tomcat6Fix deferred
Red Hat Enterprise Linux 7tomcatFix deferred
Red Hat Enterprise Linux 8pki-deps:10.6/pki-servlet-engineFix deferred
Red Hat Enterprise Linux 8tomcatFix deferred
Red Hat Enterprise Linux 9pki-servlet-engineFix deferred
Red Hat Enterprise Linux 9tomcatFix deferred
Red Hat Hardened Imagestomcat10Not affected
Red Hat JBoss Web Server 5jws5-tomcatFix deferred

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-79
https://bugzilla.redhat.com/show_bug.cgi?id=2494688tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example

EPSS

Процентиль: 90%
0.04249
Низкий

5.4 Medium

CVSS3

Связанные уязвимости

CVSS3: 6.1
ubuntu
около 1 месяца назад

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

CVSS3: 6.1
nvd
около 1 месяца назад

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

CVSS3: 6.1
debian
около 1 месяца назад

Improper Neutralization of Script-Related HTML Tags in a Web Page (Bas ...

CVSS3: 6.1
github
около 1 месяца назад

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

suse-cvrf
17 дней назад

Security update for tomcat11

EPSS

Процентиль: 90%
0.04249
Низкий

5.4 Medium

CVSS3