4.3med
CVE-2007-4724
Apache Tomcat Example Application CSRF and XSS Vulnerabilities
Also known as GHSA-g77g-vjjm-x83j
Published 19 y ago · modified 4 mo ago · JSON
CVSS
4.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.1%
percentile 82%
Public exploits
0
none known
Summary
Cross-site request forgery (CSRF) vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters.
Exploit prediction (EPSS)
2.14% probability of exploitation in the next 30 days, higher than 82% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.tomcat:tomcat | <=4.1.31 | no fix listed |
Classification
- Weakness
- CWE-352 Cross-Site Request Forgery
References
- archives.neohapsis.com /archives/bugtraq/2007-09/0040.html · mailing-list, x_refsource_BUGTRAQ, x_transferred
- securityreason.com /securityalert/3094 · third-party-advisory, x_refsource_SREASON, x_transferred
- securityfocus.com /archive/1/478491/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
- osvdb.org /41029 · vdb-entry, x_refsource_OSVDB, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2007-4724 · advisory
- web.archive.org /web/20070911063436/http://securityreason.com/securityalert/3094 · web
- web.archive.org /web/20081006123851/http://archives.neohapsis.com/archives/bugtraq/2007-09/0040.html · web
- web.archive.org /web/20200526022330/http://www.securityfocus.com/archive/1/478491/100/0/threaded · web
Sources
- CVE List: CVE-2007-4724
- GitHub Advisory: GHSA-g77g-vjjm-x83j
- NVD: CVE-2007-4724
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.