Vulnerability Name:

CVE-2007-2450 (CCN-34868)

Assigned:2007-06-13
Published:2007-06-13
Updated:2019-03-25
Summary:Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.
CVSS v3 Severity:4.8 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
3.0 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N)
3.5 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: BugTraq Mailing List, Wed Jun 13 2007 - 21:26:44 CDT
Apache Tomcat XSS vulnerability in Manager

Source: CONFIRM
Type: UNKNOWN
http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx

Source: CCN
Type: CA Security Response Blog, Jan 23 2009, 06:04 PM
CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities

Source: MITRE
Type: CNA
CVE-2007-2450

Source: CCN
Type: HP Security Bulletin HPSBUX02262 SSRT071447
HP-UX running Apache, Remote Arbitrary Code Execution, Cross Site Scripting (XSS)

Source: HP
Type: UNKNOWN
SSRT071447

Source: JVN
Type: UNKNOWN
JVN#07100457

Source: APPLE
Type: UNKNOWN
APPLE-SA-2008-06-30

Source: SUSE
Type: UNKNOWN
SUSE-SR:2009:004

Source: CCN
Type: RHSA-2007-0569
Moderate: tomcat security update

Source: CCN
Type: RHSA-2007-0876
Moderate: tomcat security update

Source: CCN
Type: RHSA-2008-0261
Moderate: Red Hat Network Satellite Server security update

Source: CCN
Type: RHSA-2008-0524
Low: Red Hat Network Satellite Server security update

Source: CCN
Type: SA25678
Apache Tomcat Manager Cross-Site Scripting

Source: SECUNIA
Type: Vendor Advisory
25678

Source: SECUNIA
Type: Vendor Advisory
26076

Source: SECUNIA
Type: Vendor Advisory
27037

Source: SECUNIA
Type: Vendor Advisory
27727

Source: SECUNIA
Type: Vendor Advisory
28549

Source: CCN
Type: SA30802
Apple Mac OS X Security Update Fixes Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
30802

Source: CCN
Type: SA30899
Sun Solaris 9 Tomcat Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
30899

Source: CCN
Type: SA30908
Sun Solaris 10 Tomcat Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
30908

Source: CCN
Type: SA33668
CA Cohesion Application Configuration Manager Apache Tomcat Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
33668

Source: CCN
Type: SA40425
Novell ZENworks Linux Management Tomcat Multiple Vulnerabilities

Source: SREASON
Type: UNKNOWN
2813

Source: CCN
Type: SECTRACK ID: 1018245
Tomcat Input Validation Holes in the JSP Examples, Manager, and Host Manager Permit Cross-Site Scripting Attacks

Source: SUNALERT
Type: UNKNOWN
239312

Source: CCN
Type: Sun Alert ID: 239312
Security Vulnerabilities in Tomcat 4.0 Shipped with Solaris 9 and 10

Source: CONFIRM
Type: UNKNOWN
http://support.apple.com/kb/HT2163

Source: CCN
Type: ASA-2007-416
HP-UX running Apache, Remote Arbitrary Code Execution, Cross Site Scripting (XSS) (HPSBUX02262)

Source: CCN
Type: ASA-2007-427
tomcat security update (RHSA-2007-0876)

Source: CCN
Type: ASA-2008-293
Security Vulnerabilities in Tomcat 4.0 Shipped with Solaris 9 and 10 (Sun 239312)

Source: CONFIRM
Type: UNKNOWN
http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540

Source: CONFIRM
Type: Patch, Vendor Advisory
http://tomcat.apache.org/security-4.html

Source: CONFIRM
Type: Patch, Vendor Advisory
http://tomcat.apache.org/security-5.html

Source: CCN
Type: Apache Tomcat Web site
Cross-site scripting: Fixed in Apache Tomcat 6.0.HEAD

Source: CONFIRM
Type: Patch, Vendor Advisory
http://tomcat.apache.org/security-6.html

Source: DEBIAN
Type: UNKNOWN
DSA-1468

Source: DEBIAN
Type: DSA-1468
tomcat5.5 -- several vulnerabilities

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2007:241

Source: CCN
Type: Novell Document ID: 7006398
Tomcat 5.0.28 in ZLM 7.3 subject to "Multiple Vendor Multiple HTTP Request Smuggling Vulnerabilities"

Source: OSVDB
Type: UNKNOWN
36079

Source: CCN
Type: OSVDB ID: 36079
Apache Tomcat Manager Uploaded Filename XSS

Source: REDHAT
Type: UNKNOWN
RHSA-2007:0569

Source: REDHAT
Type: UNKNOWN
RHSA-2008:0261

Source: BUGTRAQ
Type: UNKNOWN
20070614 [CVE-2007-2450]: Apache Tomcat XSS vulnerability in Manager

Source: BUGTRAQ
Type: UNKNOWN
20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities

Source: BUGTRAQ
Type: UNKNOWN
20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)

Source: BID
Type: UNKNOWN
24475

Source: CCN
Type: BID-24475
Apache Tomcat Manager and Host Manager Upload Script Cross-Site Scripting Vulnerability

Source: SECTRACK
Type: UNKNOWN
1018245

Source: VUPEN
Type: UNKNOWN
ADV-2007-2213

Source: VUPEN
Type: UNKNOWN
ADV-2007-3386

Source: VUPEN
Type: UNKNOWN
ADV-2008-1979

Source: VUPEN
Type: UNKNOWN
ADV-2008-1981

Source: VUPEN
Type: UNKNOWN
ADV-2009-0233

Source: XF
Type: UNKNOWN
tomcat-hostmanager-xss(34868)

Source: XF
Type: UNKNOWN
tomcat-hostmanager-xss(34868)

Source: MLIST
Type: UNKNOWN
[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/

Source: MLIST
Type: UNKNOWN
[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/

Source: MLIST
Type: UNKNOWN
[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:11287

Source: CCN
Type: CA20090123-01
Security Notice for Cohesion Tomcat

Source: FEDORA
Type: UNKNOWN
FEDORA-2007-3456

Source: SUSE
Type: SUSE-SR:2009:004
SUSE Security Summary Report

Vulnerable Configuration:Configuration 1:
  • cpe:/a:apache:tomcat:4.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.3:beta:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.9:beta:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.10:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.15:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.24:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.28:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.31:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.36:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.13:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.14:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.15:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.16:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.17:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.18:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.19:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.21:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.22:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.23:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.24:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.25:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.26:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.27:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.28:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.29:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.30:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.4:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.5:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.6:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.7:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.8:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.9:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.10:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.11:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.12:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.13:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.14:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.15:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.16:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.17:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.18:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.19:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.20:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.21:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.22:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.23:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.24:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.13:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:5::client_workstation:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:apache:tomcat:4.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.10:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.4:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.19:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.24:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.28:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.12:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.9:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.7:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.20:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.25:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.17:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.15:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.28:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.3:beta:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.31:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.36:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:4.1.9:beta:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.13:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.14:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.15:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.16:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.17:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.18:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.21:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.22:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.23:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.24:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.26:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.27:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.29:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.30:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.10:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.11:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.13:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.14:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.15:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.16:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.18:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.19:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.21:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.22:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.23:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.24:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.5:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.6:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:5.5.8:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.13:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:apache:tomcat:6.0.9:*:*:*:*:*:*:*
  • AND
  • cpe:/o:hp:hp-ux:b.11.11:*:*:*:*:*:*:*
  • OR cpe:/o:sun:solaris:9::x86:*:*:*:*:*
  • OR cpe:/o:hp:hp-ux:b.11.23:*:*:*:*:*:*:*
  • OR cpe:/o:sun:solaris:10::sparc:*:*:*:*:*
  • OR cpe:/o:sun:solaris:10::x86:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0::x86-64:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:hp:hp-ux:b.11.31:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*
  • OR cpe:/a:redhat:rhel_application_server:2:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007.1::x86-64:*:*:*:*:*
  • OR cpe:/o:sun:solaris:9::sparc:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20072450
    V
    		CVE-2007-2450
    2015-11-16
    oval:org.mitre.oval:def:20358
    P
    		DSA-1468-1 tomcat5.5
    2014-06-23
    oval:org.mitre.oval:def:7601
    P
    		DSA-1468 tomcat5.5 -- several vulnerabilities
    2014-06-23
    oval:org.mitre.oval:def:22687
    P
    		ELSA-2007:0569: tomcat security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:11287
    V
    		Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.
    2013-04-29
    oval:org.debian:def:1468
    V
    		several vulnerabilities
    2008-01-20
    oval:com.redhat.rhsa:def:20070569
    P
    		RHSA-2007:0569: tomcat security update (Moderate)
    2007-07-17
    BACK
    apache tomcat 4.0.0
    apache tomcat 4.0.1
    apache tomcat 4.0.2
    apache tomcat 4.0.3
    apache tomcat 4.0.4
    apache tomcat 4.0.5
    apache tomcat 4.0.6
    apache tomcat 4.1.0
    apache tomcat 4.1.1
    apache tomcat 4.1.2
    apache tomcat 4.1.3
    apache tomcat 4.1.3 beta
    apache tomcat 4.1.9 beta
    apache tomcat 4.1.10
    apache tomcat 4.1.15
    apache tomcat 4.1.24
    apache tomcat 4.1.28
    apache tomcat 4.1.31
    apache tomcat 4.1.36
    apache tomcat 5.0.0
    apache tomcat 5.0.1
    apache tomcat 5.0.2
    apache tomcat 5.0.3
    apache tomcat 5.0.4
    apache tomcat 5.0.5
    apache tomcat 5.0.6
    apache tomcat 5.0.7
    apache tomcat 5.0.8
    apache tomcat 5.0.9
    apache tomcat 5.0.10
    apache tomcat 5.0.11
    apache tomcat 5.0.12
    apache tomcat 5.0.13
    apache tomcat 5.0.14
    apache tomcat 5.0.15
    apache tomcat 5.0.16
    apache tomcat 5.0.17
    apache tomcat 5.0.18
    apache tomcat 5.0.19
    apache tomcat 5.0.21
    apache tomcat 5.0.22
    apache tomcat 5.0.23
    apache tomcat 5.0.24
    apache tomcat 5.0.25
    apache tomcat 5.0.26
    apache tomcat 5.0.27
    apache tomcat 5.0.28
    apache tomcat 5.0.29
    apache tomcat 5.0.30
    apache tomcat 5.5.0
    apache tomcat 5.5.1
    apache tomcat 5.5.2
    apache tomcat 5.5.3
    apache tomcat 5.5.4
    apache tomcat 5.5.5
    apache tomcat 5.5.6
    apache tomcat 5.5.7
    apache tomcat 5.5.8
    apache tomcat 5.5.9
    apache tomcat 5.5.10
    apache tomcat 5.5.11
    apache tomcat 5.5.12
    apache tomcat 5.5.13
    apache tomcat 5.5.14
    apache tomcat 5.5.15
    apache tomcat 5.5.16
    apache tomcat 5.5.17
    apache tomcat 5.5.18
    apache tomcat 5.5.19
    apache tomcat 5.5.20
    apache tomcat 5.5.21
    apache tomcat 5.5.22
    apache tomcat 5.5.23
    apache tomcat 5.5.24
    apache tomcat 6.0.0
    apache tomcat 6.0.1
    apache tomcat 6.0.2
    apache tomcat 6.0.3
    apache tomcat 6.0.4
    apache tomcat 6.0.5
    apache tomcat 6.0.6
    apache tomcat 6.0.7
    apache tomcat 6.0.8
    apache tomcat 6.0.9
    apache tomcat 6.0.10
    apache tomcat 6.0.11
    apache tomcat 6.0.12
    apache tomcat 6.0.13
    apache tomcat 4.0.1
    apache tomcat 4.0.3
    apache tomcat 4.0.4
    apache tomcat 4.1.10
    apache tomcat 4.1.0
    apache tomcat 5.5.4
    apache tomcat 5.0.19
    apache tomcat 4.1.24
    apache tomcat 5.0.28
    apache tomcat 5.5.12
    apache tomcat 5.5.9
    apache tomcat 5.5.7
    apache tomcat 5.5.20
    apache tomcat 5.0.25
    apache tomcat 5.5.17
    apache tomcat 5.0.0
    apache tomcat 4.0.0
    apache tomcat 4.0.2
    apache tomcat 4.0.5
    apache tomcat 4.0.6
    apache tomcat 4.1.1
    apache tomcat 4.1.15
    apache tomcat 4.1.2
    apache tomcat 4.1.28
    apache tomcat 4.1.3
    apache tomcat 4.1.3 beta
    apache tomcat 4.1.31
    apache tomcat 4.1.36
    apache tomcat 4.1.9 beta
    apache tomcat 5.0.1
    apache tomcat 5.0.10
    apache tomcat 5.0.11
    apache tomcat 5.0.12
    apache tomcat 5.0.13
    apache tomcat 5.0.14
    apache tomcat 5.0.15
    apache tomcat 5.0.16
    apache tomcat 5.0.17
    apache tomcat 5.0.18
    apache tomcat 5.0.2
    apache tomcat 5.0.21
    apache tomcat 5.0.22
    apache tomcat 5.0.23
    apache tomcat 5.0.24
    apache tomcat 5.0.26
    apache tomcat 5.0.27
    apache tomcat 5.0.29
    apache tomcat 5.0.3
    apache tomcat 5.0.30
    apache tomcat 5.0.4
    apache tomcat 5.0.5
    apache tomcat 5.0.6
    apache tomcat 5.0.7
    apache tomcat 5.0.8
    apache tomcat 5.0.9
    apache tomcat 5.5.0
    apache tomcat 5.5.1
    apache tomcat 5.5.10
    apache tomcat 5.5.11
    apache tomcat 5.5.13
    apache tomcat 5.5.14
    apache tomcat 5.5.15
    apache tomcat 5.5.16
    apache tomcat 5.5.18
    apache tomcat 5.5.19
    apache tomcat 5.5.2
    apache tomcat 5.5.21
    apache tomcat 5.5.22
    apache tomcat 5.5.23
    apache tomcat 5.5.24
    apache tomcat 5.5.3
    apache tomcat 5.5.5
    apache tomcat 5.5.6
    apache tomcat 5.5.8
    apache tomcat 6.0.0
    apache tomcat 6.0.1
    apache tomcat 6.0.10
    apache tomcat 6.0.11
    apache tomcat 6.0.12
    apache tomcat 6.0.13
    apache tomcat 6.0.2
    apache tomcat 6.0.3
    apache tomcat 6.0.4
    apache tomcat 6.0.5
    apache tomcat 6.0.6
    apache tomcat 6.0.7
    apache tomcat 6.0.8
    apache tomcat 6.0.9
    hp hp-ux b.11.11
    sun solaris 9
    hp hp-ux b.11.23
    sun solaris 10
    sun solaris 10
    redhat enterprise linux desktop 5.0
    redhat enterprise linux 5
    redhat enterprise linux 5
    mandrakesoft mandrake linux 2007.1
    mandrakesoft mandrake linux 2008.0
    debian debian linux 4.0
    hp hp-ux b.11.31
    redhat enterprise linux 5
    redhat rhel application server 2
    mandrakesoft mandrake linux 2008.0
    mandrakesoft mandrake linux 2007.1
    sun solaris 9