Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-3p86-xgrq-m6p6
Advisory ID github_osv/GHSA-3p86-xgrq-m6p6
Aliases CVE-2011-0013
Summary Improper Neutralization of Input During Web Page Generation in Apache Tomcat Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
http://marc.info/?l=bugtraq&m=130168502603566&w=2
http://marc.info/?l=bugtraq&m=132215163318824&w=2
http://marc.info/?l=bugtraq&m=136485229118404&w=2
http://marc.info/?l=bugtraq&m=139344343412337&w=2
https://access.redhat.com/security/cve/CVE-2011-0013
https://bugzilla.redhat.com/show_bug.cgi?id=675786
http://securityreason.com/securityalert/8093
https://github.com/apache/tomcat
https://github.com/apache/tomcat55/commit/863d77c7d321245de019ac32252828e0a025c5b4
https://github.com/apache/tomcat/commit/58223c5ecc0751c3642c810f291b8f033d33b97f
https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12878
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14945
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19269
http://support.apple.com/kb/HT5002
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html
https://web.archive.org/web/20111227000129/http://secunia.com/advisories/45022
https://web.archive.org/web/20111229163935/http://secunia.com/advisories/43192
https://web.archive.org/web/20120126065143/http://www.securityfocus.com/archive/1/516209/30/90/threaded
https://web.archive.org/web/20120126070320/http://www.securitytracker.com/id?1025026
https://web.archive.org/web/20120213130147/http://www.securityfocus.com/bid/46174
https://web.archive.org/web/20151017023138/http://secunia.com/advisories/57126
http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.32
http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.30
http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.6_%28released_14_Jan_2011%29
http://www.debian.org/security/2011/dsa-2160
http://www.mandriva.com/security/advisories?name=MDVSA-2011:030
CVE-2011-0013 https://nvd.nist.gov/vuln/detail/CVE-2011-0013
msg00000.html Advisory http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
RHSA-2011:0791 https://access.redhat.com/errata/RHSA-2011:0791
RHSA-2011:0896 https://access.redhat.com/errata/RHSA-2011:0896
RHSA-2011:0897 https://access.redhat.com/errata/RHSA-2011:0897
RHSA-2011:1845 https://access.redhat.com/errata/RHSA-2011:1845
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.