CVE-2006-7195: XSS

Q: What is the severity of CVE-2006-7195?

CVE-2006-7195 has been classified as a cross-site scripting vulnerability with a medium level of severity.

Q: How do I fix CVE-2006-7195?

To fix CVE-2006-7195, upgrade Apache Tomcat to version 5.5.18 or later.

Q: Which versions of Apache Tomcat are affected by CVE-2006-7195?

CVE-2006-7195 affects Apache Tomcat versions 5.0.0 to 5.0.30 and 5.5.0 to 5.5.17.

Q: What types of attacks can CVE-2006-7195 allow?

CVE-2006-7195 can allow attackers to execute arbitrary scripts in a user's browser.

Q: When was CVE-2006-7195 published?

CVE-2006-7195 was published on January 2, 2007.

Published Apr 19, 2007

Updated

According to http://tomcat.apache.org/security-5.html

Fixed in Apache Tomcat 5.5.18

Cross-site scripting CVE-2006-7195

The implict-objects.jsp in the examples webapp displayed a number of unfiltered header values. This enabled a XSS attack. These values are now filtered.

Affects: 5.0.0-5.0.HEAD, 5.5.0-5.5.17

Other sources

Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.

— Red Hat

Affected Software

51 affected componentsFixes available

redhat/jakarta-commons-modeler<0:1.1-8jpp.1.0.2.el5

0:1.1-8jpp.1.0.2.el5

redhat/tomcat5<0:5.5.23-0jpp.1.0.3.el5

0:5.5.23-0jpp.1.0.3.el5

redhat/java<1.4.2-ibm-0:1.4.2.10-1jpp.2.el4

1.4.2-ibm-0:1.4.2.10-1jpp.2.el4

redhat/rhn-apache<0:1.3.27-36.rhn.rhel4

0:1.3.27-36.rhn.rhel4

redhat/rhn-modjk<0:1.2.23-2rhn.rhel4

0:1.2.23-2rhn.rhel4

redhat/rhn-modperl<0:1.29-16.rhel4

0:1.29-16.rhel4

redhat/rhn-modssl<0:2.8.12-8.rhn.10.rhel4

0:2.8.12-8.rhn.10.rhel4

redhat/java<1.4.2-ibm-0:1.4.2.10-1jpp.2.el3

1.4.2-ibm-0:1.4.2.10-1jpp.2.el3

redhat/rhn-apache<0:1.3.27-36.rhn.rhel3

0:1.3.27-36.rhn.rhel3

redhat/rhn-modjk<0:1.2.23-2rhn.rhel3

0:1.2.23-2rhn.rhel3

redhat/rhn-modperl<0:1.29-16.rhel3

0:1.29-16.rhel3

redhat/rhn-modssl<0:2.8.12-8.rhn.10.rhel3

0:2.8.12-8.rhn.10.rhel3

maven/org.apache.tomcat:tomcat>=5.5.0<=5.5.17

5.5.18

maven/org.apache.tomcat:tomcat>=5.0.0<=5.0.30

Tomcat=5.0.0

Tomcat=5.0.1

Tomcat=5.0.2

Tomcat=5.0.10

Tomcat=5.0.11

Tomcat=5.0.12

Tomcat=5.0.13

Tomcat=5.0.14

Tomcat=5.0.15

Tomcat=5.0.16

Tomcat=5.0.17

Tomcat=5.0.18

Tomcat=5.0.19

Tomcat=5.0.21

Tomcat=5.0.22

Tomcat=5.0.23

Tomcat=5.0.24

Tomcat=5.0.25

Tomcat=5.0.26

Tomcat=5.0.27

Tomcat=5.0.28

Tomcat=5.0.29

Tomcat=5.0.30

Tomcat=5.5.0

Tomcat=5.5.5

Tomcat=5.5.6

Tomcat=5.5.7

Tomcat=5.5.8

Tomcat=5.5.9

Tomcat=5.5.10

Tomcat=5.5.11

Tomcat=5.5.12

Tomcat=5.5.13

Tomcat=5.5.14

Tomcat=5.5.15

Tomcat=5.5.16

Tomcat=5.5.17

Event History

Apr 19, 2007

CVE Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:02 PM

DescriptionSeverityAffected Software

May 9, 2007

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

May 1, 2022

Advisory Published

via GitHub·07:45 AM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2006-7195?

CVE-2006-7195 has been classified as a cross-site scripting vulnerability with a medium level of severity.

How do I fix CVE-2006-7195?