CVE-2005-4838 in Jakarta Tomcat
요약 (영어)
Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp. NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
예약하다
2007. 04. 25.
공개
2005. 12. 31.
상태
확인됨
엔트리
VulDB provides additional information and datapoints for this CVE:
| 아이디 | 취약성 | CWE | 악용 | 대책 | CVE |
|---|---|---|---|---|---|
| 1096 | Apache Jakarta Tomcat Messenger functions.jsp 크로스 사이트 스크립팅 | 79 | 높음 | 공식 수정 | CVE-2005-4838 |