Vulnerability Name:

CVE-2007-1355 (CCN-34377)

Assigned:2007-05-19
Published:2007-05-19
Updated:2019-03-25
Summary:Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.
CVSS v3 Severity:4.8 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
4.1 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N)
3.8 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N/E:H/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: BugTraq Mailing List, Sat May 19 2007 - 10:08:08 CDT
[CVE-2007-1355] Tomcat documentation XSS vulnerabilities

Source: CONFIRM
Type: UNKNOWN
http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx

Source: CCN
Type: CA Security Response Blog, Jan 23 2009, 06:04 PM
CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities

Source: MITRE
Type: CNA
CVE-2007-1355

Source: CCN
Type: HP Security Bulletin HPSBUX02262 SSRT071447
HP-UX running Apache, Remote Arbitrary Code Execution, Cross Site Scripting (XSS)

Source: HP
Type: UNKNOWN
SSRT071447

Source: APPLE
Type: UNKNOWN
APPLE-SA-2008-06-30

Source: OSVDB
Type: UNKNOWN
34875

Source: CCN
Type: RHSA-2008-0261
Moderate: Red Hat Network Satellite Server security update

Source: CCN
Type: RHSA-2008-0524
Low: Red Hat Network Satellite Server security update

Source: CCN
Type: RHSA-2008-0630
Low: Red Hat Network Satellite Server security update

Source: REDHAT
Type: UNKNOWN
RHSA-2008:0630

Source: SECUNIA
Type: UNKNOWN
27037

Source: SECUNIA
Type: UNKNOWN
27727

Source: CCN
Type: SA30802
Apple Mac OS X Security Update Fixes Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
30802

Source: CCN
Type: SA30899
Sun Solaris 9 Tomcat Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
30899

Source: CCN
Type: SA30908
Sun Solaris 10 Tomcat Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
30908

Source: SECUNIA
Type: UNKNOWN
31493

Source: CCN
Type: SA33668
CA Cohesion Application Configuration Manager Apache Tomcat Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
33668

Source: SREASON
Type: UNKNOWN
2722

Source: SUNALERT
Type: UNKNOWN
239312

Source: CCN
Type: Sun Alert ID: 239312
Security Vulnerabilities in Tomcat 4.0 Shipped with Solaris 9 and 10

Source: CONFIRM
Type: UNKNOWN
http://support.apple.com/kb/HT2163

Source: CCN
Type: ASA-2007-416
HP-UX running Apache, Remote Arbitrary Code Execution, Cross Site Scripting (XSS) (HPSBUX02262)

Source: CCN
Type: ASA-2008-293
Security Vulnerabilities in Tomcat 4.0 Shipped with Solaris 9 and 10 (Sun 239312)

Source: CONFIRM
Type: UNKNOWN
http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540

Source: CCN
Type: Apache Tomcat Web site
Apache Tomcat - Apache Tomcat

Source: CONFIRM
Type: UNKNOWN
http://tomcat.apache.org/security-4.html

Source: CONFIRM
Type: UNKNOWN
http://tomcat.apache.org/security-5.html

Source: CONFIRM
Type: UNKNOWN
http://tomcat.apache.org/security-6.html

Source: CCN
Type: OSVDB ID: 34875
Apache Tomcat appdev/sample/web/hello.jsp Multiple Parameter XSS

Source: REDHAT
Type: UNKNOWN
RHSA-2008:0261

Source: BUGTRAQ
Type: UNKNOWN
20070519 [CVE-2007-1355] Tomcat documentation XSS vulnerabilities

Source: BUGTRAQ
Type: UNKNOWN
20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities

Source: BUGTRAQ
Type: UNKNOWN
20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)

Source: BID
Type: Exploit, Patch
24058

Source: CCN
Type: BID-24058
Apache Tomcat Documentation Sample Application Multiple Cross-Site Scripting Vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2007-3386

Source: VUPEN
Type: UNKNOWN
ADV-2008-1979

Source: VUPEN
Type: UNKNOWN
ADV-2008-1981

Source: VUPEN
Type: UNKNOWN
ADV-2009-0233

Source: XF
Type: UNKNOWN
tomcat-hello-xss(34377)

Source: XF
Type: UNKNOWN
tomcat-hello-xss(34377)

Source: MLIST
Type: UNKNOWN
[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/

Source: MLIST
Type: UNKNOWN
[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/

Source: MLIST
Type: UNKNOWN
[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:6111

Source: CCN
Type: CA20090123-01
Security Notice for Cohesion Tomcat

Source: FEDORA
Type: UNKNOWN
FEDORA-2007-3456

Vulnerable Configuration:Configuration 1:
  • cpe:/a:apache:tomcat:4.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.10:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.15:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.24:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.28:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.31:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.13:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.14:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.15:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.16:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.17:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.18:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.19:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.21:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.22:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.23:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.24:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.25:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.26:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.27:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.28:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.29:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.30:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.10:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:apache:tomcat:4.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.10:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.19:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.24:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.28:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.25:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.15:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.28:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.31:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.13:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.14:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.15:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.16:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.17:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.18:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.21:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.22:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.23:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.24:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.26:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.27:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.29:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.30:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.9:*:*:*:*:*:*:*
  • AND
  • cpe:/o:hp:hp-ux:b.11.11:*:*:*:*:*:*:*
  • OR cpe:/o:sun:solaris:9::x86:*:*:*:*:*
  • OR cpe:/o:hp:hp-ux:b.11.23:*:*:*:*:*:*:*
  • OR cpe:/o:sun:solaris:10::sparc:*:*:*:*:*
  • OR cpe:/o:sun:solaris:10::x86:*:*:*:*:*
  • OR cpe:/o:hp:hp-ux:b.11.31:*:*:*:*:*:*:*
  • OR cpe:/o:sun:solaris:9::sparc:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:6111
    V
    		HP-UX running Apache, Remote Arbitrary Code Execution, Cross Site Scripting (XSS)
    2015-04-20
    BACK
    apache tomcat 4.0.0
    apache tomcat 4.0.1
    apache tomcat 4.0.2
    apache tomcat 4.0.3
    apache tomcat 4.0.4
    apache tomcat 4.0.5
    apache tomcat 4.0.6
    apache tomcat 4.1.10
    apache tomcat 4.1.15
    apache tomcat 4.1.24
    apache tomcat 4.1.28
    apache tomcat 4.1.31
    apache tomcat 5.0.1
    apache tomcat 5.0.2
    apache tomcat 5.0.3
    apache tomcat 5.0.4
    apache tomcat 5.0.5
    apache tomcat 5.0.6
    apache tomcat 5.0.7
    apache tomcat 5.0.8
    apache tomcat 5.0.9
    apache tomcat 5.0.10
    apache tomcat 5.0.11
    apache tomcat 5.0.12
    apache tomcat 5.0.13
    apache tomcat 5.0.14
    apache tomcat 5.0.15
    apache tomcat 5.0.16
    apache tomcat 5.0.17
    apache tomcat 5.0.18
    apache tomcat 5.0.19
    apache tomcat 5.0.21
    apache tomcat 5.0.22
    apache tomcat 5.0.23
    apache tomcat 5.0.24
    apache tomcat 5.0.25
    apache tomcat 5.0.26
    apache tomcat 5.0.27
    apache tomcat 5.0.28
    apache tomcat 5.0.29
    apache tomcat 5.0.30
    apache tomcat 6.0.0
    apache tomcat 6.0.1
    apache tomcat 6.0.2
    apache tomcat 6.0.3
    apache tomcat 6.0.4
    apache tomcat 6.0.5
    apache tomcat 6.0.6
    apache tomcat 6.0.7
    apache tomcat 6.0.8
    apache tomcat 6.0.9
    apache tomcat 6.0.10
    apache tomcat 4.0.1
    apache tomcat 4.0.3
    apache tomcat 4.0.4
    apache tomcat 4.1.10
    apache tomcat 5.0.19
    apache tomcat 4.1.24
    apache tomcat 5.0.28
    apache tomcat 5.0.25
    apache tomcat 4.0.0
    apache tomcat 4.0.2
    apache tomcat 4.0.5
    apache tomcat 4.0.6
    apache tomcat 4.1.15
    apache tomcat 4.1.28
    apache tomcat 4.1.31
    apache tomcat 5.0.1
    apache tomcat 5.0.10
    apache tomcat 5.0.11
    apache tomcat 5.0.12
    apache tomcat 5.0.13
    apache tomcat 5.0.14
    apache tomcat 5.0.15
    apache tomcat 5.0.16
    apache tomcat 5.0.17
    apache tomcat 5.0.18
    apache tomcat 5.0.2
    apache tomcat 5.0.21
    apache tomcat 5.0.22
    apache tomcat 5.0.23
    apache tomcat 5.0.24
    apache tomcat 5.0.26
    apache tomcat 5.0.27
    apache tomcat 5.0.29
    apache tomcat 5.0.3
    apache tomcat 5.0.30
    apache tomcat 5.0.4
    apache tomcat 5.0.5
    apache tomcat 5.0.6
    apache tomcat 5.0.7
    apache tomcat 5.0.8
    apache tomcat 5.0.9
    apache tomcat 6.0.0
    apache tomcat 6.0.1
    apache tomcat 6.0.10
    apache tomcat 6.0.2
    apache tomcat 6.0.3
    apache tomcat 6.0.4
    apache tomcat 6.0.5
    apache tomcat 6.0.6
    apache tomcat 6.0.7
    apache tomcat 6.0.8
    apache tomcat 6.0.9
    hp hp-ux b.11.11
    sun solaris 9
    hp hp-ux b.11.23
    sun solaris 10
    sun solaris 10
    hp hp-ux b.11.31
    sun solaris 9