Description
Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.
Remediation
References
http://www.securityfocus.com/bid/45015
http://tomcat.apache.org/security-6.html
http://secunia.com/advisories/42337
http://svn.apache.org/viewvc?view=revision&revision=1037779
http://svn.apache.org/viewvc?view=revision&revision=1037778
http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0285.html
http://securitytracker.com/id?1024764
http://www.vupen.com/english/advisories/2010/3047
http://tomcat.apache.org/security-7.html
https://bugzilla.redhat.com/show_bug.cgi?id=656246
http://www.ubuntu.com/usn/USN-1048-1
http://www.vupen.com/english/advisories/2011/0203
http://secunia.com/advisories/43019
http://www.redhat.com/support/errata/RHSA-2011-0896.html
http://www.redhat.com/support/errata/RHSA-2011-0897.html
http://www.redhat.com/support/errata/RHSA-2011-0791.html
http://support.apple.com/kb/HT5002
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
http://secunia.com/advisories/45022
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html
http://marc.info/?l=bugtraq&m=139344343412337&w=2
http://secunia.com/advisories/57126
https://exchange.xforce.ibmcloud.com/vulnerabilities/63422
http://www.securityfocus.com/archive/1/514866/100/0/threaded
Related Vulnerabilities
CVE-2023-33831 Vulnerability in npm package @frangoteam/fuxa
CVE-2023-26487 Vulnerability in npm package vega-functions
CVE-2020-28455 Vulnerability in npm package markdown-it-toc
CVE-2018-16473 Vulnerability in npm package takeapeek
CVE-2022-41966 Vulnerability in maven package com.thoughtworks.xstream:xstream