Vulnerability Assessment & Network Security Forums



If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important.  If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery.


Home >> Browse Vulnerability Assessment Database >> CGI abuses : XSS >> Apache Tomcat DOS Device Name XSS


Vulnerability Assessment Details

Apache Tomcat DOS Device Name XSS

Vulnerability Assessment Summary
Tests for Apache Tomcat DOS Device name XSS Bug

Detailed Explanation for this Vulnerability Assessment

Summary :

The remote Apache Tomcat web server is vulnerable to a cross site scripting
issue.


Description :

Apache Tomcat is the servlet container that is used in the official Reference
Implementation for the Java Servlet and JavaServer Pages technologies.

By making requests for DOS Device names it is possible to cause
Tomcat to throw an exception, permiting XSS attacks, e.g:

tomcat-server/COM2.IMG%20src='Javascript:alert(document.domain)'

(angle brackets omitted)

The exception also reveals the physical path of the Tomcat installation.

Solution :

Upgrade to Apache Tomcat v4.1.3 beta or later.

See also :

http://www.westpoint.ltd.uk/advisories/wp-02-0008.txt

Network Security Threat Level:

Low / CVSS Base Score : 3
(AV:R/AC:H/Au:NR/C:P/A:N/I:N/B:C)

Networks Security ID: 5194

Vulnerability Assessment Copyright: This script is Copyright (C) 2002 Matt Moore

Cables, Connectors


Lenovo SATA Solid State Internal Hard Drive ST800, 128GB/256GB/512GB/1TB, NEW picture

Lenovo SATA Solid State Internal Hard Drive ST800, 128GB/256GB/512GB/1TB, NEW

$45.99



DT8XJ Dell Intel DC S3700 800GB SATA 6Gb/s 2.5

DT8XJ Dell Intel DC S3700 800GB SATA 6Gb/s 2.5" SSD 0DT8XJ SSDSC2BA800G3R

$59.00



Dell 800GB SSD U.2 NVMe 2.5

Dell 800GB SSD U.2 NVMe 2.5" PCIe Gen3 KWH83 MZWLL800HEHP-000D3 PM1725a

$59.99



Toshiba 512GB SSD Solid State Drive 2.5

Toshiba 512GB SSD Solid State Drive 2.5" SATA THNSNC512GBSJ Sun Oracle 7010845

$59.99



Netac 1TB 2TB 512GB Internal SSD 2.5'' SATA III 6Gb/s Solid State Drive lot picture

Netac 1TB 2TB 512GB Internal SSD 2.5'' SATA III 6Gb/s Solid State Drive lot

$13.99



Major Brand 120GB 2.5

Major Brand 120GB 2.5" SATA SSD for Laptop / Desktop PC - 2 Years Warranty

$11.99



Fanxiang 4TB 2TB 1TB SSD 550MB/s 2.5'' SATA III Internal Solid State Drive lot picture

Fanxiang 4TB 2TB 1TB SSD 550MB/s 2.5'' SATA III Internal Solid State Drive lot

$21.99



Fanxiang M.2 SATA SSD 2TB 1TB 512GB 256GB SSD Internal M2 Solid State Drive Lot picture

Fanxiang M.2 SATA SSD 2TB 1TB 512GB 256GB SSD Internal M2 Solid State Drive Lot

$35.99



Fanxiang SSD 512GB 1TB 2TB 4TB 2.5'' SSD SATA III Internal Solid State Drive lot picture

Fanxiang SSD 512GB 1TB 2TB 4TB 2.5'' SSD SATA III Internal Solid State Drive lot

$198.99



Fanxiang 1TB 2TB 4TB SSD 2.5'' SATA III 560MB/s Internal Solid State Drive LOT picture

Fanxiang 1TB 2TB 4TB SSD 2.5'' SATA III 560MB/s Internal Solid State Drive LOT

$197.99



Discussions

No Discussions have been posted on this vulnerability.