XSS in Apache Tomcat

CVE-2008-1947

Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.098 (95.0th percentile) — read the EPSS interpretation.

Affected products

  • Apache Tomcat — versions 5.5.9, 5.5.10, 5.5.11
  • N/a — versions n/a

Weakness classification (CWE)

References