CVE-2009-0781: XSS
Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML."
Other sources
Quoting the upstream advisory:
The calendar application in the examples contains invalid HTML which renders the XSS protection for the time parameter ineffective. An attacker can therefore perform an XSS attack using the time attribute.
Mitigation: 6.0.x users should do one of the following: - remove the examples web application - apply this patch http://svn.apache.org/viewvc?rev=750924&view=rev - upgrade to 6.0.19 when released 5.5.x users should do one of the following: - remove the examples web application - apply this patch http://svn.apache.org/viewvc?rev=750928&view=rev - upgrade to 5.5.28 when released 4.1.x users should do one of the following: - remove the examples web application - apply this patch http://svn.apache.org/viewvc?rev=750927&view=rev - upgrade to 4.1.40 when released
Example: http://localhost:8080/examples/jsp/cal/cal2.jsp?time=8am%20STYLE=xss:e//xpression(try{a=firstTime}catch(e){firstTime=1;alert('XSS')});
Credit: This issue was discovered by Deniz Cevik.
References: http://tomcat.apache.org/security.html http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-5.html
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/tomcat5to a version that resolves this vulnerability.Fixed in 0:5.5.23-0jpp.7.el5_3.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch rev=750924 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch rev=750927 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch rev=750928 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 4.1.40 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 5.5.28 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 6.0.19 - Remove
Remove
examples web applicationfrom your environment.remove the examples web application
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2009-0781?
CVE-2009-0781 has a medium severity rating, as it allows remote attackers to exploit cross-site scripting vulnerabilities.
How do I fix CVE-2009-0781?
To fix CVE-2009-0781, update your Apache Tomcat installation to version 5.5.28 or later, as these versions have patched the vulnerability.
Which versions of Apache Tomcat are affected by CVE-2009-0781?
CVE-2009-0781 affects Apache Tomcat versions 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18.
What type of vulnerability is CVE-2009-0781?
CVE-2009-0781 is classified as a cross-site scripting (XSS) vulnerability.
Can CVE-2009-0781 be exploited without user interaction?
Yes, CVE-2009-0781 can be exploited by remote attackers without requiring user interaction.