CVE-2007-2449: XSS
Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ; character, as demonstrated by a URI containing a snp/snoop.jsp; sequence.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-2449?
The severity of CVE-2007-2449 is classified as medium due to its potential for cross-site scripting attacks.
How do I fix CVE-2007-2449?
To fix CVE-2007-2449, upgrade to a version of Apache Tomcat that is not affected, such as versions later than 6.0.13.
What versions of Apache Tomcat are affected by CVE-2007-2449?
CVE-2007-2449 affects Apache Tomcat versions from 4.0.0 to 6.0.13 inclusive.
What types of attacks can be executed due to CVE-2007-2449?
CVE-2007-2449 allows remote attackers to perform cross-site scripting (XSS) attacks by injecting arbitrary web scripts or HTML.
Are there any workarounds for CVE-2007-2449?
Temporary workarounds for CVE-2007-2449 may include sanitizing user inputs and validating output to mitigate the risk of XSS attacks.