CVE-2010-4172

MEDIUM

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.

References

http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0285.html

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

http://marc.info/?l=bugtraq&m=139344343412337&w=2

http://secunia.com/advisories/42337

http://secunia.com/advisories/43019

http://secunia.com/advisories/45022

http://secunia.com/advisories/57126

http://securitytracker.com/id?1024764

http://support.apple.com/kb/HT5002

http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html

http://svn.apache.org/viewvc?view=revision&revision=1037778

http://svn.apache.org/viewvc?view=revision&revision=1037779

http://tomcat.apache.org/security-6.html

http://tomcat.apache.org/security-7.html

http://www.redhat.com/support/errata/RHSA-2011-0791.html

http://www.redhat.com/support/errata/RHSA-2011-0896.html

http://www.redhat.com/support/errata/RHSA-2011-0897.html

http://www.securityfocus.com/archive/1/514866/100/0/threaded

http://www.securityfocus.com/bid/45015

http://www.ubuntu.com/usn/USN-1048-1

http://www.vupen.com/english/advisories/2010/3047

http://www.vupen.com/english/advisories/2011/0203

https://bugzilla.redhat.com/show_bug.cgi?id=656246

https://exchange.xforce.ibmcloud.com/vulnerabilities/63422

Details

Source: MITRE

Published: 2010-11-26

Updated: 2018-10-10

Type: CWE-79

Risk Information

CVSS v2.0

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

Tenable Plugins

View all (14 total)

IDNameProductFamilySeverity
75760openSUSE Security Update : tomcat6 (openSUSE-SU-2011:0082-1)NessusSuSE Local Security Checks
medium
61051Scientific Linux Security Update : tomcat6 on SL6.x i386/x86_64NessusScientific Linux Local Security Checks
medium
59677GLSA-201206-24 : Apache Tomcat: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
56481Mac OS X Multiple Vulnerabilities (Security Update 2011-006)NessusMacOS X Local Security Checks
critical
54601RHEL 6 : tomcat6 (RHSA-2011:0791)NessusRed Hat Local Security Checks
medium
53806openSUSE Security Update : tomcat6 (openSUSE-SU-2011:0082-2)NessusSuSE Local Security Checks
medium
53805openSUSE Security Update : tomcat6 (openSUSE-SU-2011:0082-1)NessusSuSE Local Security Checks
medium
51975Apache Tomcat 6.0.x < 6.0.30 Multiple VulnerabilitiesNessusWeb Servers
medium
800614Apache Tomcat 7.0.x < 7.0.5 Cross-Site Scripting VulnerabilityLog Correlation EngineWeb Servers
medium
5793Apache Tomcat 7.0.x < 7.0.5 Multiple XSSNessus Network MonitorWeb Servers
medium
800609Apache Tomcat 6.0.x < 6.0.30 Multiple VulnerabilitiesLog Correlation EngineWeb Servers
medium
5789Apache Tomcat 6.0.x < 6.0.30 Multiple VulnerabilitiesNessus Network MonitorWeb Servers
medium
51669Ubuntu 9.10 / 10.04 LTS / 10.10 : tomcat6 vulnerability (USN-1048-1)NessusUbuntu Local Security Checks
medium
51526Apache Tomcat 6.x < 6.0.30 / 7.x < 7.0.5 Multiple XSSNessusWeb Servers
medium