[Full-disclosure] CVE-2007-3384: XSS in Tomcat cookies example

From: Mark Thomas <markt_at_nospam>
Date: Thu Aug 02 2007 - 03:18:45 GMT
To: Tomcat Users List <users@tomcat.apache.org>, Tomcat Developers List <dev@tomcat.apache.org>, bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

CVE-2007-3384: XSS in Tomcat cookies example

Severity:
Low (Cross-site scripting)

Vendor:
The Apache Software Foundation

Versions Affected:
3.3 to 3.3.2

Description:
When reporting error messages, Tomcat does not filter user supplied data before display. This enables an XSS attack.

Mitigation:
Remove examples web application.
Apply patch available from http://tomcat.apache.org/download-33.cgi

Credit:
This issue was discovered by Tomasz Kuczynski, Poznan Supercomputing and Networking Center, who worked with the CERT/CC to report the vulnerability.

Example:
http://localhost:8080/examples/servlet/CookieExample populate Name or Value field with:
<script>alert('XSS reflected');</script> and submit.

References:
http://tomcat.apache.org/security.html
-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGsU0Vb7IeiTPGAkMRAoiwAJ4iETiZnDPLKM0v69YZ/FaIhGS8GwCgt+ux FB0O3FigwHs+A8pP98+gRiA=
=VePF
-----END PGP SIGNATURE-----

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

This message: [ Message body ]
Next message: edi.strosar_at_nospam: "[Full-disclosure] DVD Rental System multiple XSS and CSRF vulnerabilities"
Previous message: rPath Update Announcements: "[Full-disclosure] rPSA-2007-0153-1 qt-x11-free"

Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ]