CVE-2010-4172

Published: Nov 26, 2010Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.

Affected (20)

Products: Apache: Tomcat

1 product

Configuration A

20 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	Version 6.0.12
Apache Tomcat	Version 6.0.13
Apache Tomcat	Version 6.0.14
Apache Tomcat	Version 6.0.15
Apache Tomcat	Version 6.0.16
Apache Tomcat	Version 6.0.17
Apache Tomcat	Version 6.0.18
Apache Tomcat	Version 6.0.19
Apache Tomcat	Version 6.0.20
Apache Tomcat	Version 6.0.24
Apache Tomcat	Version 6.0.26
Apache Tomcat	Version 6.0.27
Apache Tomcat	Version 6.0.28
Apache Tomcat	Version 6.0.29
Apache Tomcat	Version 7.0.0
Apache Tomcat	Version 7.0.0 beta
Apache Tomcat	Version 7.0.1
Apache Tomcat	Version 7.0.2
Apache Tomcat	Version 7.0.3
Apache Tomcat	Version 7.0.4

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (48)

http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0285.html

Source: secalert@redhat.com

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=139344343412337&w=2

Source: secalert@redhat.com

http://secunia.com/advisories/42337

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/43019

Source: secalert@redhat.com

http://secunia.com/advisories/45022

Source: secalert@redhat.com

http://secunia.com/advisories/57126

Source: secalert@redhat.com

http://securitytracker.com/id?1024764

Source: secalert@redhat.com

http://support.apple.com/kb/HT5002

Source: secalert@redhat.com

http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html

Source: secalert@redhat.com

http://svn.apache.org/viewvc?view=revision&revision=1037778

Source: secalert@redhat.com

http://svn.apache.org/viewvc?view=revision&revision=1037779

Source: secalert@redhat.com

http://tomcat.apache.org/security-6.html

Source: secalert@redhat.com

http://tomcat.apache.org/security-7.html

Source: secalert@redhat.com

PatchVendor Advisory

http://www.redhat.com/support/errata/RHSA-2011-0791.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2011-0896.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2011-0897.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/514866/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/45015

Source: secalert@redhat.com

Exploit

http://www.ubuntu.com/usn/USN-1048-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/3047

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2011/0203

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=656246

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/63422

Source: secalert@redhat.com

http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0285.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=139344343412337&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/42337

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/43019

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/45022

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/57126

Source: af854a3a-2127-422b-91ae-364da2661108

http://securitytracker.com/id?1024764

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.apple.com/kb/HT5002

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.apache.org/viewvc?view=revision&revision=1037778

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.apache.org/viewvc?view=revision&revision=1037779

Source: af854a3a-2127-422b-91ae-364da2661108

http://tomcat.apache.org/security-6.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://tomcat.apache.org/security-7.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.redhat.com/support/errata/RHSA-2011-0791.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2011-0896.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2011-0897.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/514866/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/45015

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.ubuntu.com/usn/USN-1048-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/3047

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.vupen.com/english/advisories/2011/0203

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=656246

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/63422

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.