CVE-2009-2696: XSS
Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.
Other sources
The RHSA-2009:1164 Tomcat security update for Red Hat Enterprise Linux 5 did not, unlike the erratum text stated, provide a fix for CVE-2009-0781, a cross-site scripting (XSS) flaw in the examples calendar application. A missing patch is considered a security regression, and requires a new CVE name. This regression is assigned CVE-2009-2696. It fixes the same issue as CVE-2009-0781 and is specific to Red Hat Enterprise Linux 5.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2696?
CVE-2009-2696 is categorized as a moderate severity cross-site scripting vulnerability.
How do I fix CVE-2009-2696?
To fix CVE-2009-2696, update the Apache Tomcat version to 5.5.23-0jpp.9.el5_5 or higher.
Which software is affected by CVE-2009-2696?
CVE-2009-2696 affects Apache Tomcat versions prior to 5.5.23 and other related applications on Red Hat platforms.
What type of attack is enabled by CVE-2009-2696?
CVE-2009-2696 allows remote attackers to perform cross-site scripting attacks by injecting arbitrary web scripts into web pages.
Is there a workaround for CVE-2009-2696?
There is no official workaround for CVE-2009-2696, but the best practice is to update to a patched version of Apache Tomcat.