CVE-2008-1232: XSS
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
Other sources
The message argument of HttpServletResponse.sendError() call is not only displayed on the error page, but is also used for the reason-phrase of HTTP response. This may include characters that are illegal in HTTP headers. It is possible for a specially crafted message to result in arbitrary content being injected into the HTTP response. For a successful XSS attack, unfiltered user supplied data must be included in the message argument.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2008-1232?
CVE-2008-1232 is classified as a high severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2008-1232?
To fix CVE-2008-1232, upgrade affected Apache Tomcat versions to 6.0.17, 5.5.27, or 4.1.38.
Which Apache Tomcat versions are affected by CVE-2008-1232?
The affected Apache Tomcat versions include 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16.
What is the impact of CVE-2008-1232?
The impact of CVE-2008-1232 allows remote attackers to inject arbitrary web script or HTML into web applications.
Is CVE-2008-1232 an XSS vulnerability?
Yes, CVE-2008-1232 is a cross-site scripting (XSS) vulnerability affecting multiple versions of Apache Tomcat.