X

The Third Party Vulnerability Resolution Blog covers CVEs and patches in Systems product suite.

Sun Alert 251986 Security Vulnerabilities in Tomcat 5.5 may Lead to Cross Site Scripting (XSS) or Directory Traversal

Guest Author
Product: Solaris 9 Operating System Solaris 10 Operating System OpenSolaris

There are three security vulnerabilities in the Tomcat JSP/Servlet container that affect Tomcat 5.5 bundled in Solaris 9 and Solaris 10.

The first two security vulnerabilities are Cross Site Scripting (XSS) issues. One in the HttpServletResponse.sendError method (CVE-2008-1232) and the other in the Tomcat Virtual Host Manager (CVE-2008-1947). These may allow a local or remote unprivileged user to inject arbitrary web script or HTML, which in turn may allow the unprivileged user to bypass access control and gain access to unauthorized data.

The third security vulnerability is a Directory Traversal vulnerability in the RequestDispatcher class (CVE-2008-2370) that may allow a local or remote unprivileged user to bypass access control and gain access to unauthorized data.

Additional information regarding these issues is available at:
State: Resolved
First released: 25-Feb-2009

Be the first to comment

Comments ( 0 )
Please enter your name.Please provide a valid email address.Please enter a comment.CAPTCHA challenge response provided was incorrect. Please try again.