CVE-2007-3386

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 59.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-08-14 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.

Affected products

Apache Tomcat: 5.5.0, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5 (+33)

References

http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554
http://jvn.jp/jp/JVN%2359851336/index.html
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
http://osvdb.org/36417
http://secunia.com/advisories/26465
http://secunia.com/advisories/26898
http://secunia.com/advisories/27037
http://secunia.com/advisories/27267
http://secunia.com/advisories/27727
http://secunia.com/advisories/28317

Get alerted when CVE-2007-3386 or the next vulnerability affects your stack