Description
Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.
Remediation
References
http://www.securityfocus.com/bid/45015
http://tomcat.apache.org/security-6.html
http://secunia.com/advisories/42337
http://svn.apache.org/viewvc?view=revision&revision=1037779
http://svn.apache.org/viewvc?view=revision&revision=1037778
http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0285.html
http://securitytracker.com/id?1024764
http://www.vupen.com/english/advisories/2010/3047
http://tomcat.apache.org/security-7.html
https://bugzilla.redhat.com/show_bug.cgi?id=656246
http://www.ubuntu.com/usn/USN-1048-1
http://www.vupen.com/english/advisories/2011/0203
http://secunia.com/advisories/43019
http://www.redhat.com/support/errata/RHSA-2011-0896.html
http://www.redhat.com/support/errata/RHSA-2011-0897.html
http://www.redhat.com/support/errata/RHSA-2011-0791.html
http://support.apple.com/kb/HT5002
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
http://secunia.com/advisories/45022
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html
http://marc.info/?l=bugtraq&m=139344343412337&w=2
http://secunia.com/advisories/57126
https://exchange.xforce.ibmcloud.com/vulnerabilities/63422
http://www.securityfocus.com/archive/1/514866/100/0/threaded
Related Vulnerabilities
CVE-2022-0235 Vulnerability in npm package node-fetch
CVE-2018-6464 Vulnerability in maven package org.webjars.bower:simditor
CVE-2022-25898 Vulnerability in npm package jsrsasign
CVE-2012-0391 Vulnerability in maven package org.apache.struts:struts2-core
CVE-2016-10735 Vulnerability in maven package org.ow2.jonas:bootstrap