CVE-2005-4838: XSS
Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp. NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2005-4838?
CVE-2005-4838 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
What are the affected versions for CVE-2005-4838?
CVE-2005-4838 affects Apache Tomcat versions 5.5.6 and earlier.
How do I fix CVE-2005-4838?
To fix CVE-2005-4838, upgrade your Apache Tomcat installation to version 5.5.7 or later.
What types of vulnerabilities does CVE-2005-4838 represent?
CVE-2005-4838 represents multiple cross-site scripting (XSS) vulnerabilities in example web applications.
Can CVE-2005-4838 allow remote code execution?
CVE-2005-4838 does not directly allow remote code execution but enables attackers to inject and execute arbitrary web scripts.