Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for
    Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.
    (CVE-2003-0044)

According to its self-reported version number, the instance of Apache Tomcat 3.x listening on the remote host is prior to 3.3.2, It is, therefore, affected by multiple vulnerabilities.

Unspecified cross-site scripting vulnerabilities exist in the 'ROOT' and example applications shipped with this version of Tomcat.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The developers of tomcat discovered several problems in tomcat version 3.x. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2003-0042: A maliciously crafted request could     return a directory listing even when an index.html,     index.jsp, or other welcome file is present. File     contents can be returned as well.
  - CAN-2003-0043: A malicious web application could read     the contents of some files outside the web application     via its web.xml file in spite of the presence of a     security manager. The content of files that can be read     as part of an XML document would be accessible.

  - CAN-2003-0044: A cross-site scripting vulnerability was     discovered in the included sample web application that     allows remote attackers to execute arbitrary script     code.

ID	Name	Product	Family	Severity
432028	SCA: security update for org.apache.tomcat:tomcat (GHSA-5hgm-qm5m-5vmw)	Tenable Cloud Security	SCA Checks	medium
432028	SCA: security update for org.apache.tomcat:tomcat (GHSA-5hgm-qm5m-5vmw)	Tenable Self-Hosted Container Security	SCA Checks	medium
50526	Apache Tomcat 3.x < 3.3.2 Multiple Vulnerabilities	Nessus	Web Servers	medium
15083	Debian DSA-246-1 : tomcat - information exposure, XSS	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2003-0044

medium

Tenable Plugins

medium

medium

medium

medium