CVE-2010-4172: XSS
A cross-site-scripting flaw was discovered in the manager application. It reflected the user provided parameters sort and orderBy directly without filtering applied.
The issue affects Tomcat 6 (impact=moderate):
From 6.0.12 to 6.0.29 and was fixed in r1037779:
http://svn.apache.org/viewvc?rev=1037779&view=rev
Upstream 6.0.30 will correct this flaw as noted:
http://tomcat.apache.org/security-6.html
The issue affects Tomcat 7 (impact=low, as caught by CSRF protection) : From 7.0.0 to 7.0.4 and was fixed in r1037778:
http://svn.apache.org/viewvc?rev=1037778&view=rev
Upstream 7.0.5 will correct this flaw as noted:
http://tomcat.apache.org/security-7.html
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.
— Debian
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4172?
The severity of CVE-2010-4172 is categorized as moderate.
How do I fix CVE-2010-4172?
To fix CVE-2010-4172, upgrade to Apache Tomcat version 7.0.5 or later.
Which Apache Tomcat versions are affected by CVE-2010-4172?
CVE-2010-4172 affects Apache Tomcat versions 6.0.12 to 6.0.29 and some 7.0.x versions up to 7.0.4.
What type of vulnerability is CVE-2010-4172?
CVE-2010-4172 is a cross-site scripting (XSS) vulnerability.
Is there a workaround for CVE-2010-4172 if I can't upgrade?
There are no recommended workarounds for CVE-2010-4172; upgrading is advised to mitigate the vulnerability.