CVE-2007-1355
medium · 4.3Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.
4.3
CVSS
58.2%
EPSS (exploit prob.)
99th
EPSS percentile
2007-05-21
Published
AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| apache | tomcat | 4.0.0 |
| apache | tomcat | 4.0.1 |
| apache | tomcat | 4.0.2 |
| apache | tomcat | 4.0.3 |
| apache | tomcat | 4.0.4 |
| apache | tomcat | 4.0.5 |
| apache | tomcat | 4.0.6 |
| apache | tomcat | 4.1.10 |
| apache | tomcat | 4.1.15 |
| apache | tomcat | 4.1.24 |
| apache | tomcat | 4.1.28 |
| apache | tomcat | 4.1.31 |
| apache | tomcat | 5.0.1 |
| apache | tomcat | 5.0.2 |
| apache | tomcat | 5.0.3 |
| apache | tomcat | 5.0.4 |
| apache | tomcat | 5.0.5 |
| apache | tomcat | 5.0.6 |
| apache | tomcat | 5.0.7 |
| apache | tomcat | 5.0.8 |
| apache | tomcat | 5.0.9 |
| apache | tomcat | 5.0.10 |
| apache | tomcat | 5.0.11 |
| apache | tomcat | 5.0.12 |
| apache | tomcat | 5.0.13 |
| apache | tomcat | 5.0.14 |
| apache | tomcat | 5.0.15 |
| apache | tomcat | 5.0.16 |
| apache | tomcat | 5.0.17 |
| apache | tomcat | 5.0.18 |
| apache | tomcat | 5.0.19 |
| apache | tomcat | 5.0.21 |
| apache | tomcat | 5.0.22 |
| apache | tomcat | 5.0.23 |
| apache | tomcat | 5.0.24 |
| apache | tomcat | 5.0.25 |
| apache | tomcat | 5.0.26 |
| apache | tomcat | 5.0.27 |
| apache | tomcat | 5.0.28 |
| apache | tomcat | 5.0.29 |
Check a specific version with /api/v1/cve/match.
References
- http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
- http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
- http://osvdb.org/34875
- http://rhn.redhat.com/errata/RHSA-2008-0630.html
- http://secunia.com/advisories/27037
- http://secunia.com/advisories/27727
- http://secunia.com/advisories/30802
- http://secunia.com/advisories/30899
- http://secunia.com/advisories/30908
- http://secunia.com/advisories/31493
- http://secunia.com/advisories/33668
- http://securityreason.com/securityalert/2722
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1
- http://support.apple.com/kb/HT2163
- http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
- http://tomcat.apache.org/security-4.html
- http://tomcat.apache.org/security-5.html
- http://tomcat.apache.org/security-6.html
- http://www.redhat.com/support/errata/RHSA-2008-0261.html
- http://www.securityfocus.com/archive/1/469067/100/0/threaded
- http://www.securityfocus.com/archive/1/500396/100/0/threaded
- http://www.securityfocus.com/archive/1/500412/100/0/threaded
- http://www.securityfocus.com/bid/24058
- http://www.vupen.com/english/advisories/2007/3386
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2007-1355