CVE-2006-7195

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-05-10 · updated 2026-06-16

Description

Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.

Affected products

Apache Tomcat: 5.0.0, 5.0.1, 5.0.2, 5.0.10, 5.0.11, 5.0.12 (+31)

References

http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
http://lists.vmware.com/pipermail/security-announce/2008/000003.html
http://secunia.com/advisories/28365
http://secunia.com/advisories/33668
http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm
http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
http://tomcat.apache.org/security-5.html
http://www.redhat.com/support/errata/RHSA-2007-0327.html
http://www.redhat.com/support/errata/RHSA-2008-0261.html
http://www.securityfocus.com/archive/1/485938/100/0/threaded
http://www.securityfocus.com/archive/1/500396/100/0/threaded
http://www.securityfocus.com/archive/1/500412/100/0/threaded

Get alerted when CVE-2006-7195 or the next vulnerability affects your stack