REDHAT-BUG-489028: XSS
First published: Fri Mar 06 2009(Updated: )
Quoting the upstream advisory: The calendar application in the examples contains invalid HTML which renders the XSS protection for the time parameter ineffective. An attacker can therefore perform an XSS attack using the time attribute. Mitigation: 6.0.x users should do one of the following: - remove the examples web application - apply this patch <a href="http://svn.apache.org/viewvc?rev=750924&view=rev">http://svn.apache.org/viewvc?rev=750924&view=rev</a> - upgrade to 6.0.19 when released 5.5.x users should do one of the following: - remove the examples web application - apply this patch <a href="http://svn.apache.org/viewvc?rev=750928&view=rev">http://svn.apache.org/viewvc?rev=750928&view=rev</a> - upgrade to 5.5.28 when released 4.1.x users should do one of the following: - remove the examples web application - apply this patch <a href="http://svn.apache.org/viewvc?rev=750927&view=rev">http://svn.apache.org/viewvc?rev=750927&view=rev</a> - upgrade to 4.1.40 when released Example: <a href="http://localhost:8080/examples/jsp/cal/cal2.jsp?time=8am%20STYLE=xss:e/**/xpression(try{a=firstTime}catch(e){firstTime=1;alert('XSS">http://localhost:8080/examples/jsp/cal/cal2.jsp?time=8am%20STYLE=xss:e/**/xpression(try{a=firstTime}catch(e){firstTime=1;alert('XSS</a>')}); Credit: This issue was discovered by Deniz Cevik. References: <a href="http://tomcat.apache.org/security.html">http://tomcat.apache.org/security.html</a> <a href="http://tomcat.apache.org/security-6.html">http://tomcat.apache.org/security-6.html</a> <a href="http://tomcat.apache.org/security-5.html">http://tomcat.apache.org/security-5.html</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tomcat | >=6.0.0<=6.0.19>=5.5.0<=5.5.28>=4.1.0<=4.1.40 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://svn.apache.org/viewvc?rev=750924&view=rev
- http://svn.apache.org/viewvc?rev=750928&view=rev
- http://svn.apache.org/viewvc?rev=750927&view=rev
- http://localhost:8080/examples/jsp/cal/cal2.jsp?time=8am%20STYLE=xss:e/**/xpression(try{a=firstTime}catch(e){firstTime=1;alert('XSS
- http://tomcat.apache.org/security.html
- http://tomcat.apache.org/security-6.html
- http://tomcat.apache.org/security-5.html
- https://rhn.redhat.com/errata/RHSA-2009-1164.html
- https://access.redhat.com/security/cve/CVE-2009-0781
- https://rhn.redhat.com/errata/RHSA-2009-1562.html
- https://bugzilla.redhat.com/show_bug.cgi?id=489028
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2009-0781
- agent/references
- agent/weakness
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/apache
- canonical/tomcat