{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/43172?format=json","vulnerability_id":"VCID-w8uj-zy2r-fyca","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nMultiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a \"snp/snoop.jsp;\" sequence.","aliases":[{"alias":"CVE-2007-2449"},{"alias":"GHSA-hc39-rjwp-qffq"}],"fixed_packages":[],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61623?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@4.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2af1-rv9j-jugv"},{"vulnerability":"VCID-2jws-wtvg-2khf"},{"vulnerability":"VCID-aywp-amq3-yyes"},{"vulnerability":"VCID-ccfn-tde4-s7hr"},{"vulnerability":"VCID-hxer-p6va-7kdh"},{"vulnerability":"VCID-kxc3-vz2c-wqca"},{"vulnerability":"VCID-sjn3-a6fs-gyck"},{"vulnerability":"VCID-w8uj-zy2r-fyca"},{"vulnerability":"VCID-wpnp-3yad-ybcj"},{"vulnerability":"VCID-zam7-79x3-ekg3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@4.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/61635?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@4.0.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2jws-wtvg-2khf"},{"vulnerability":"VCID-96yu-fvee-wfbs"},{"vulnerability":"VCID-kxc3-vz2c-wqca"},{"vulnerability":"VCID-sjn3-a6fs-gyck"},{"vulnerability":"VCID-w8uj-zy2r-fyca"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@4.0.6"},{"url":"http://public2.vulnerablecode.io/api/packages/61709?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@5.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-24v5-jpna-rqg9"},{"vulnerability":"VCID-2af1-rv9j-jugv"},{"vulnerability":"VCID-4t2h-jjhm-y7fq"},{"vulnerability":"VCID-atus-ryef-17h1"},{"vulnerability":"VCID-cqz2-4njt-g3da"},{"vulnerability":"VCID-crhe-rt8j-wycu"},{"vulnerability":"VCID-kxc3-vz2c-wqca"},{"vulnerability":"VCID-qz87-x4zb-rud7"},{"vulnerability":"VCID-w8uj-zy2r-fyca"},{"vulnerability":"VCID-zam7-79x3-ekg3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@5.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/61710?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@5.0.30","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-cqz2-4njt-g3da"},{"vulnerability":"VCID-qz87-x4zb-rud7"},{"vulnerability":"VCID-w8uj-zy2r-fyca"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@5.0.30"},{"url":"http://public2.vulnerablecode.io/api/packages/61691?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@5.5.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2af1-rv9j-jugv"},{"vulnerability":"VCID-46sr-9kr3-1ubw"},{"vulnerability":"VCID-74c7-a56p-kufz"},{"vulnerability":"VCID-7787-4bwm-efgq"},{"vulnerability":"VCID-89e9-m968-vfhe"},{"vulnerability":"VCID-9hm5-e4dw-6ffe"},{"vulnerability":"VCID-9j31-459b-4qbm"},{"vulnerability":"VCID-cqz2-4njt-g3da"},{"vulnerability":"VCID-eawm-8v9w-yfap"},{"vulnerability":"VCID-eygg-nt7y-qubh"},{"vulnerability":"VCID-fu9h-e3jx-abe2"},{"vulnerability":"VCID-hmqa-jhuf-hfe2"},{"vulnerability":"VCID-jw6e-g8z9-43ej"},{"vulnerability":"VCID-kxc3-vz2c-wqca"},{"vulnerability":"VCID-pzkk-4e94-aqag"},{"vulnerability":"VCID-qz87-x4zb-rud7"},{"vulnerability":"VCID-rdr4-db3y-p3cz"},{"vulnerability":"VCID-t4mh-zvhq-27du"},{"vulnerability":"VCID-w6ay-nzvg-zbff"},{"vulnerability":"VCID-w8uj-zy2r-fyca"},{"vulnerability":"VCID-wg7f-pjmn-uudk"},{"vulnerability":"VCID-wtke-y2cx-x3et"},{"vulnerability":"VCID-y9yv-u4jh-mqew"},{"vulnerability":"VCID-yvcg-96dp-r7e6"},{"vulnerability":"VCID-zm75-zwps-h3fv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@5.5.0"},{"url":"http://public2.vulnerablecode.io/api/packages/61711?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@5.5.24","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-qz87-x4zb-rud7"},{"vulnerability":"VCID-w8uj-zy2r-fyca"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@5.5.24"},{"url":"http://public2.vulnerablecode.io/api/packages/61688?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@6.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2kjh-4r2g-rqe6"},{"vulnerability":"VCID-46sr-9kr3-1ubw"},{"vulnerability":"VCID-4t2h-jjhm-y7fq"},{"vulnerability":"VCID-5m85-3zyu-7qak"},{"vulnerability":"VCID-6uuq-2a39-yubx"},{"vulnerability":"VCID-74c7-a56p-kufz"},{"vulnerability":"VCID-7787-4bwm-efgq"},{"vulnerability":"VCID-89e9-m968-vfhe"},{"vulnerability":"VCID-9hm5-e4dw-6ffe"},{"vulnerability":"VCID-9j31-459b-4qbm"},{"vulnerability":"VCID-aar2-398x-p3d8"},{"vulnerability":"VCID-atus-ryef-17h1"},{"vulnerability":"VCID-axzz-cadr-b7fv"},{"vulnerability":"VCID-crhe-rt8j-wycu"},{"vulnerability":"VCID-eawm-8v9w-yfap"},{"vulnerability":"VCID-eygg-nt7y-qubh"},{"vulnerability":"VCID-f4ka-47dk-zffs"},{"vulnerability":"VCID-fu9h-e3jx-abe2"},{"vulnerability":"VCID-fuxz-fqw3-ufa9"},{"vulnerability":"VCID-hmqa-jhuf-hfe2"},{"vulnerability":"VCID-hqzu-shyu-j3hp"},{"vulnerability":"VCID-jw6e-g8z9-43ej"},{"vulnerability":"VCID-kxc3-vz2c-wqca"},{"vulnerability":"VCID-n4zk-mdyw-3fcz"},{"vulnerability":"VCID-pq53-6deg-abfx"},{"vulnerability":"VCID-pzkk-4e94-aqag"},{"vulnerability":"VCID-qz87-x4zb-rud7"},{"vulnerability":"VCID-qzyq-d6qk-67ag"},{"vulnerability":"VCID-rdr4-db3y-p3cz"},{"vulnerability":"VCID-redv-2x5y-8khx"},{"vulnerability":"VCID-s37s-p75k-27e6"},{"vulnerability":"VCID-t3ya-1w1r-h3dv"},{"vulnerability":"VCID-t4mh-zvhq-27du"},{"vulnerability":"VCID-tcmv-6ftg-fqen"},{"vulnerability":"VCID-vsta-e8jg-4qa8"},{"vulnerability":"VCID-w8uj-zy2r-fyca"},{"vulnerability":"VCID-wg7f-pjmn-uudk"},{"vulnerability":"VCID-wtke-y2cx-x3et"},{"vulnerability":"VCID-y9yv-u4jh-mqew"},{"vulnerability":"VCID-yswq-hnqg-sycs"},{"vulnerability":"VCID-yvcg-96dp-r7e6"},{"vulnerability":"VCID-zm75-zwps-h3fv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@6.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/61712?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@6.0.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-qz87-x4zb-rud7"},{"vulnerability":"VCID-w8uj-zy2r-fyca"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@6.0.13"}],"references":[{"reference_url":"http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html","reference_id":"","reference_type":"","scores":[],"url":"http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html"},{"reference_url":"http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00008.html","reference_id":"","reference_type":"","scores":[],"url":"http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00008.html"},{"reference_url":"http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html","reference_id":"","reference_type":"","scores":[],"url":"http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2008-0630.html","reference_id":"","reference_type":"","scores":[],"url":"http://rhn.redhat.com/errata/RHSA-2008-0630.html"},{"reference_url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/34869","reference_id":"","reference_type":"","scores":[],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/34869"},{"reference_url":"https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E"},{"reference_url":"http://support.apple.com/kb/HT2163","reference_id":"","reference_type":"","scores":[],"url":"http://support.apple.com/kb/HT2163"},{"reference_url":"http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540","reference_id":"","reference_type":"","scores":[],"url":"http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540"},{"reference_url":"https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html","reference_id":"","reference_type":"","scores":[],"url":"https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html"},{"reference_url":"http://tomcat.apache.org/security-4.html","reference_id":"","reference_type":"","scores":[],"url":"http://tomcat.apache.org/security-4.html"},{"reference_url":"http://tomcat.apache.org/security-5.html","reference_id":"","reference_type":"","scores":[],"url":"http://tomcat.apache.org/security-5.html"},{"reference_url":"http://tomcat.apache.org/security-6.html","reference_id":"","reference_type":"","scores":[],"url":"http://tomcat.apache.org/security-6.html"},{"reference_url":"http://www.redhat.com/support/errata/RHSA-2007-0569.html","reference_id":"","reference_type":"","scores":[],"url":"http://www.redhat.com/support/errata/RHSA-2007-0569.html"},{"reference_url":"http://www.redhat.com/support/errata/RHSA-2008-0261.html","reference_id":"","reference_type":"","scores":[],"url":"http://www.redhat.com/support/errata/RHSA-2008-0261.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2007-2449","reference_id":"CVE-2007-2449","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-2449"},{"reference_url":"https://github.com/advisories/GHSA-hc39-rjwp-qffq","reference_id":"GHSA-hc39-rjwp-qffq","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-hc39-rjwp-qffq"}],"weaknesses":[{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."},{"cwe_id":79,"name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."},{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."}],"exploits":[],"severity_range_score":null,"exploitability":null,"weighted_severity":null,"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-w8uj-zy2r-fyca"}