Apache Tomcat XSS Vulnerabilities in Examples Web Application

Also known as GHSA-hc39-rjwp-qffq

Published 19 y ago 2007-06-14 · modified 4 mo ago 2026-06-16 · JSON

CVSS

4.3

v2.0 · NVD

CISA KEV

not known exploited

EPSS

77.4%

percentile 100%

Public exploits

Exploit-DB · Nuclei check

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

Exploit prediction (EPSS)

77.38% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

Nuclei template Apache Tomcat 4.x-7.x - Cross-Site Scripting · nuclei detection template
EDB-30189 Apache Tomcat 6.0.13 - JSP Example Web Applications Cross-Site Scripting · webapps · 2007-06-14

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.apache.tomcat:tomcat`	>=4.0.0, <=4.0.6 >=5.0.0, <=5.0.30 >=5.5.0, <=5.5.24 >=6.0.0, <=6.0.13	no fix listed

References

tomcat.apache.org /security-4.html · x_refsource_CONFIRM, x_transferred
support.apple.com /kb/HT2163 · x_refsource_CONFIRM, x_transferred
rhn.redhat.com /errata/RHSA-2008-0630.html · vendor-advisory, x_refsource_REDHAT, x_transferred
vupen.com /english/advisories/2008/1981/references · vdb-entry, x_refsource_VUPEN, x_transferred
redhat.com /archives/fedora-package-announce/2007-November/msg00525.html · vendor-advisory, x_refsource_FEDORA, x_transferred
securityfocus.com /bid/24476 · vdb-entry, x_refsource_BID, x_transferred
secunia.com /advisories/31493 · third-party-advisory, x_refsource_SECUNIA, x_transferred
securityfocus.com /archive/1/471351/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
securityreason.com /securityalert/2804 · third-party-advisory, x_refsource_SREASON, x_transferred
redhat.com /support/errata/RHSA-2007-0569.html · vendor-advisory, x_refsource_REDHAT, x_transferred
exchange.xforce.ibmcloud.com /vulnerabilities/34869 · vdb-entry, x_refsource_XF, x_transferred
securityfocus.com /archive/1/500412/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
securitytracker.com /id?1018245 · vdb-entry, x_refsource_SECTRACK, x_transferred
secunia.com /advisories/33668 · third-party-advisory, x_refsource_SECUNIA, x_transferred
secunia.com /advisories/29392 · third-party-advisory, x_refsource_SECUNIA, x_transferred
securityfocus.com /archive/1/500396/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
lists.opensuse.org /opensuse-security-announce/2008-03/msg00008.html · vendor-advisory, x_refsource_SUSE, x_transferred
lists.apple.com /archives/security-announce/2008//Jun/msg00002.html · vendor-advisory, x_refsource_APPLE, x_transferred
vupen.com /english/advisories/2009/0233 · vdb-entry, x_refsource_VUPEN, x_transferred
lists.opensuse.org /opensuse-security-announce/2009-02/msg00002.html · vendor-advisory, x_refsource_SUSE, x_transferred
tomcat.apache.org /security-6.html · x_refsource_CONFIRM, x_transferred
vupen.com /english/advisories/2007/3386 · vdb-entry, x_refsource_VUPEN, x_transferred
secunia.com /advisories/30802 · third-party-advisory, x_refsource_SECUNIA, x_transferred
secunia.com /advisories/27037 · third-party-advisory, x_refsource_SECUNIA, x_transferred
h20000.www2.hp.com /bizsupport/TechSupport/Document.jsp?objectID=c01178795 · vendor-advisory, x_refsource_HP, x_transferred
secunia.com /advisories/27727 · third-party-advisory, x_refsource_SECUNIA, x_transferred
tomcat.apache.org /security-5.html · x_refsource_CONFIRM, x_transferred
redhat.com /support/errata/RHSA-2008-0261.html · vendor-advisory, x_refsource_REDHAT, x_transferred
osvdb.org /36080 · vdb-entry, x_refsource_OSVDB, x_transferred
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10578 · vdb-entry, signature, x_refsource_OVAL, x_transferred
secunia.com /advisories/26076 · third-party-advisory, x_refsource_SECUNIA, x_transferred
vupen.com /english/advisories/2007/2213 · vdb-entry, x_refsource_VUPEN, x_transferred
community.ca.com /blogs/casecurityresponseblog/archive/2009/01/23.aspx · x_refsource_CONFIRM, x_transferred
support.ca.com /irj/portal/anonymous/phpsupcontent?contentID=197540 · x_refsource_CONFIRM, x_transferred
mandriva.com /security/advisories?name=MDKSA-2007:241 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
lists.apache.org /thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
nvd.nist.gov /vuln/detail/CVE-2007-2449 · advisory
lists.apache.org /thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache · web
lists.apache.org /thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache · web
lists.apache.org /thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache · web
lists.apache.org /thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache · web
lists.apache.org /thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apach · web

Sources

CVE List: CVE-2007-2449
GitHub Advisory: GHSA-hc39-rjwp-qffq
NVD: CVE-2007-2449

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.