CVE-2006-7196: XSS
Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-7196?
CVE-2006-7196 is classified as a medium severity vulnerability due to its potential impact on user data through cross-site scripting (XSS) attacks.
How do I fix CVE-2006-7196?
To fix CVE-2006-7196, upgrade Apache Tomcat to a version above 5.5.15, which addresses this XSS vulnerability.
Which versions of Apache Tomcat are affected by CVE-2006-7196?
CVE-2006-7196 affects Apache Tomcat versions 4.0.0 through 5.5.15, including several minor versions.
What types of attacks can be executed using CVE-2006-7196?
Exploiting CVE-2006-7196 allows remote attackers to inject arbitrary web scripts or HTML into the calendar application via a crafted time parameter.
Can CVE-2006-7196 be exploited without authentication?
Yes, CVE-2006-7196 can be exploited by unauthenticated users since it targets the calendar application's URL response.