Advisory details:
github_osv / GHSA-c78g-qwpw-2jgv
| Advisory ID | github_osv/GHSA-c78g-qwpw-2jgv |
| Aliases |
CVE-2010-4172
|
| Summary | Improper Neutralization of Input During Web Page Generation in Apache Tomcat Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| generic_textual | MODERATE |
| Data source | Exploit-DB |
|---|---|
| Date added | Nov. 22, 2010 |
| Description | Apache Tomcat 7.0.4 - 'sort' / 'orderBy' Cross-Site Scripting |
| Ransomware campaign use | Known |
| Source publication date | Nov. 22, 2010 |
| Exploit type | remote |
| Platform | linux |
| Source update date | Oct. 20, 2014 |
| Source URL | https://www.securityfocus.com/bid/45015/info |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no SSVC decisions available.