CVE-2010-4172

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 42.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-11-26 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.

Affected products

Apache Tomcat: 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.0.16, 6.0.17 (+14)

References

http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0285.html
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
http://marc.info/?l=bugtraq&m=139344343412337&w=2
http://secunia.com/advisories/42337
http://secunia.com/advisories/43019
http://secunia.com/advisories/45022
http://secunia.com/advisories/57126
http://securitytracker.com/id?1024764
http://support.apple.com/kb/HT5002
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html
http://svn.apache.org/viewvc?view=revision&revision=1037778
http://svn.apache.org/viewvc?view=revision&revision=1037779

Get alerted when CVE-2010-4172 or the next vulnerability affects your stack