CVE-2010-4172

EUVD-2022-3524
Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 93%
Affected Products (NVD)
VendorProductVersion
apachetomcat
6.0.12
apachetomcat
6.0.13
apachetomcat
6.0.14
apachetomcat
6.0.15
apachetomcat
6.0.16
apachetomcat
6.0.17
apachetomcat
6.0.18
apachetomcat
6.0.19
apachetomcat
6.0.20
apachetomcat
6.0.24
apachetomcat
6.0.26
apachetomcat
6.0.27
apachetomcat
6.0.28
apachetomcat
6.0.29
apachetomcat
7.0.0
apachetomcat
7.0.0:beta
apachetomcat
7.0.1
apachetomcat
7.0.2
apachetomcat
7.0.3
apachetomcat
7.0.4
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
tomcat5
dapper
ignored
hardy
dne
karmic
dne
lucid
dne
maverick
dne
natty
dne
tomcat5.5
dapper
dne
hardy
ignored
karmic
dne
lucid
dne
maverick
dne
natty
dne
tomcat6
dapper
dne
hardy
dne
karmic
Fixed 6.0.20-2ubuntu2.3
released
lucid
Fixed 6.0.24-2ubuntu1.6
released
maverick
Fixed 6.0.28-2ubuntu1.1
released
natty
not-affected
Common Weakness Enumeration
References
http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0285.html
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
http://marc.info/?l=bugtraq&m=139344343412337&w=2
http://secunia.com/advisories/42337
http://secunia.com/advisories/43019
http://secunia.com/advisories/45022
http://secunia.com/advisories/57126
http://securitytracker.com/id?1024764
http://support.apple.com/kb/HT5002
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html
http://svn.apache.org/viewvc?view=revision&revision=1037778
http://svn.apache.org/viewvc?view=revision&revision=1037779
http://tomcat.apache.org/security-6.html
http://tomcat.apache.org/security-7.html
http://www.redhat.com/support/errata/RHSA-2011-0791.html
http://www.redhat.com/support/errata/RHSA-2011-0896.html
http://www.redhat.com/support/errata/RHSA-2011-0897.html
http://www.securityfocus.com/archive/1/514866/100/0/threaded
http://www.securityfocus.com/bid/45015
http://www.ubuntu.com/usn/USN-1048-1
http://www.vupen.com/english/advisories/2010/3047
http://www.vupen.com/english/advisories/2011/0203
https://bugzilla.redhat.com/show_bug.cgi?id=656246
https://exchange.xforce.ibmcloud.com/vulnerabilities/63422
http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0285.html
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
http://marc.info/?l=bugtraq&m=139344343412337&w=2
http://secunia.com/advisories/42337
http://secunia.com/advisories/43019
http://secunia.com/advisories/45022
http://secunia.com/advisories/57126
http://securitytracker.com/id?1024764
http://support.apple.com/kb/HT5002
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html
http://svn.apache.org/viewvc?view=revision&revision=1037778
http://svn.apache.org/viewvc?view=revision&revision=1037779
http://tomcat.apache.org/security-6.html
http://tomcat.apache.org/security-7.html
http://www.redhat.com/support/errata/RHSA-2011-0791.html
http://www.redhat.com/support/errata/RHSA-2011-0896.html
http://www.redhat.com/support/errata/RHSA-2011-0897.html
http://www.securityfocus.com/archive/1/514866/100/0/threaded
http://www.securityfocus.com/bid/45015
http://www.ubuntu.com/usn/USN-1048-1
http://www.vupen.com/english/advisories/2010/3047
http://www.vupen.com/english/advisories/2011/0203
https://bugzilla.redhat.com/show_bug.cgi?id=656246
https://exchange.xforce.ibmcloud.com/vulnerabilities/63422