The flaw is a set of cross-site scripting vulnerabilities in several JSP files of the examples web application shipped with Apache Tomcat. An attacker can inject arbitrary script or HTML through the part of the URI after a ';' character, as shown by a crafted URI containing a "snp/snoop.jsp;" sequence, and the attack requires a victim to be lured into requesting that URL.
Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.
Public exploit code (Exploit-DB) was available the same day.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: org.apache.tomcat:tomcat.
No fixed version published. Check the advisory or remove the package.
| If you run | Upgrade to |
|---|---|
| 6.0.0 through 6.0.13 | No fix published |
| 5.5.0 through 5.5.24 | No fix published |
| 5.0.0 through 5.0.30 | No fix published |
| 4.0.0 through 4.0.6 | No fix published |
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.