CVE-2007-3386: XSS
Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3386?
CVE-2007-3386 is considered a moderate severity vulnerability that allows cross-site scripting (XSS) attacks.
How do I fix CVE-2007-3386?
To fix CVE-2007-3386, upgrade Apache Tomcat to version 6.0.14 or later and 5.5.25 or later.
What versions of Apache Tomcat are affected by CVE-2007-3386?
CVE-2007-3386 affects Apache Tomcat versions 5.5.0 to 5.5.24 and 6.0.0 to 6.0.13.
What types of attacks can be performed using the CVE-2007-3386 vulnerability?
The CVE-2007-3386 vulnerability can be exploited to inject and execute arbitrary HTML and web scripts in a user's browser.
Is CVE-2007-3386 widely exploitable?
Yes, CVE-2007-3386 can be exploited by attackers who can craft specific HTTP requests to the Host Manager Servlet.