Description
Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.
Remediation
References
http://www.securityfocus.com/bid/45015
http://tomcat.apache.org/security-6.html
http://secunia.com/advisories/42337
http://svn.apache.org/viewvc?view=revision&revision=1037779
http://svn.apache.org/viewvc?view=revision&revision=1037778
http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0285.html
http://securitytracker.com/id?1024764
http://www.vupen.com/english/advisories/2010/3047
http://tomcat.apache.org/security-7.html
https://bugzilla.redhat.com/show_bug.cgi?id=656246
http://www.ubuntu.com/usn/USN-1048-1
http://www.vupen.com/english/advisories/2011/0203
http://secunia.com/advisories/43019
http://www.redhat.com/support/errata/RHSA-2011-0896.html
http://www.redhat.com/support/errata/RHSA-2011-0897.html
http://www.redhat.com/support/errata/RHSA-2011-0791.html
http://support.apple.com/kb/HT5002
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
http://secunia.com/advisories/45022
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html
http://marc.info/?l=bugtraq&m=139344343412337&w=2
http://secunia.com/advisories/57126
https://exchange.xforce.ibmcloud.com/vulnerabilities/63422
http://www.securityfocus.com/archive/1/514866/100/0/threaded
Related Vulnerabilities
CVE-2023-49375 Vulnerability in maven package com.jfinal:jfinal
CVE-2023-34035 Vulnerability in maven package org.springframework.security:spring-security-config
CVE-2018-14042 Vulnerability in maven package org.webjars.npm:bootstrap-sass
CVE-2022-42124 Vulnerability in maven package com.liferay:com.liferay.layout.page.template.service
CVE-2023-32981 Vulnerability in maven package org.jenkins-ci.plugins:pipeline-utility-steps