VulnerableCode Advisory Details - GHSA-f98p-9pp6-7q6c

System	Score	Found at
cvssv4	5.3	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f98p-9pp6-7q6c/GHSA-f98p-9pp6-7q6c.json
generic_textual	MODERATE

System

Score

Found at

cvssv4

5.3

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f98p-9pp6-7q6c/GHSA-f98p-9pp6-7q6c.json

generic_textual

MODERATE

Reference id

Reference type

URL

http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html

http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html

http://marc.info/?l=bugtraq&m=123376588623823&w=2

http://marc.info/?l=bugtraq&m=139344343412337&w=2

http://marc.info/?l=tomcat-user&m=121244319501278&w=2

https://bugzilla.redhat.com/show_bug.cgi?id=446393

https://exchange.xforce.ibmcloud.com/vulnerabilities/42816

https://github.com/apache/tomcat

https://github.com/apache/tomcat/commit/49c71fc59c1b8f8da77aea9eb53e61db168aebab

https://github.com/apache/tomcat/commit/5f00d434c8dc11bd49ce0b4b56fe889839056030

https://github.com/apache/tomcat/commit/78ad0fcbe29c824f1f2e45a4e2716247b033250a

https://github.com/apache/tomcat/commit/ab6a6c41ac972c845717c9d639f0335865afab4d

https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E

https://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11534

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6009

http://support.apple.com/kb/HT3216

http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm

https://web.archive.org/web/20200514224656/http://www.securityfocus.com/archive/1/507985/100/0/threaded

https://web.archive.org/web/20201208011750/http://www.securityfocus.com/archive/1/492958/100/0/threaded

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00712.html

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00859.html

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00889.html

http://tomcat.apache.org/security-5.html

http://tomcat.apache.org/security-6.html

http://www.debian.org/security/2008/dsa-1593

http://www.mandriva.com/security/advisories?name=MDVSA-2008:188

http://www.vmware.com/security/advisories/VMSA-2009-0002.html

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

CVE-2008-1947

https://access.redhat.com/security/cve/CVE-2008-1947

CVE-2008-1947

https://nvd.nist.gov/vuln/detail/CVE-2008-1947

RHSA-2008:0648

https://access.redhat.com/errata/RHSA-2008:0648

RHSA-2008-0648.html

http://www.redhat.com/support/errata/RHSA-2008-0648.html

RHSA-2008:0862

https://access.redhat.com/errata/RHSA-2008:0862

RHSA-2008-0862.html

http://www.redhat.com/support/errata/RHSA-2008-0862.html

RHSA-2008:0864

https://access.redhat.com/errata/RHSA-2008:0864

RHSA-2008-0864.html

http://www.redhat.com/support/errata/RHSA-2008-0864.html

RHSA-2008:1007

https://access.redhat.com/errata/RHSA-2008:1007

Patch URL
There are no known patches.

Patch URL

There are no known patches.

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f98p-9pp6-7q6c/GHSA-f98p-9pp6-7q6c.json

Attack Vector (AV)	Attack Complexity (AC)	Attack Requirements (AT)	Privileges Required (PR)	User Interaction (UI)	Vulnerable System Impact Confidentiality (VC)	Vulnerable System Impact Integrity (VI)	Vulnerable System Impact Availability (VA)	Subsequent System Impact Confidentiality (SC)	Subsequent System Impact Integrity (SI)	Subsequent System Impact Availability (SA)
network adjacent local physical	low high	none present	none low high	none passive active	high low none	high low none	high low none	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Attack Requirements (AT)

Privileges Required (PR)

User Interaction (UI)

Vulnerable System Impact Confidentiality (VC)

Vulnerable System Impact Integrity (VI)

Vulnerable System Impact Availability (VA)

Subsequent System Impact Confidentiality (SC)

Subsequent System Impact Integrity (SI)

Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

Advisory ID	github_osv/GHSA-f98p-9pp6-7q6c
Aliases	CVE-2008-1947
Summary	Apache Tomcat Cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to `host-manager/html/add`.
Status	Published
Exploitability	0.5
Weighted Severity	4.8
Risk	2.4
Affected and Fixed Packages	Package Details
Introduced and Fixed Package Commit Patches	Package Commit Patches Details