NVD

Id
15457  
Name
CVE-2010-4172  
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-18  
Published
2010-11-26  
Modified Date
2014-03-16  
Seq
2010-4172  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
87312 15457 CVE-2010-4172 20101122 [SECURITY] CVE-2010-4172: Apache Tomcat Manager application XSS vulnerability  View
87313 15457 CVE-2010-4172 APPLE-SA-2011-10-12-3  View
87314 15457 CVE-2010-4172 HPSBST02955  View
87315 15457 CVE-2010-4172 1024764  View
87316 15457 CVE-2010-4172 http://support.apple.com/kb/HT5002  View
87317 15457 CVE-2010-4172 http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html  View
87318 15457 CVE-2010-4172 http://svn.apache.org/viewvc?view=revision&revision=1037778  View
87319 15457 CVE-2010-4172 http://svn.apache.org/viewvc?view=revision&revision=1037779  View
87320 15457 CVE-2010-4172 http://tomcat.apache.org/security-6.html  View
87321 15457 CVE-2010-4172 http://tomcat.apache.org/security-7.html  View
87322 15457 CVE-2010-4172 RHSA-2011:0791  View
87323 15457 CVE-2010-4172 RHSA-2011:0896  View
87324 15457 CVE-2010-4172 RHSA-2011:0897  View
87325 15457 CVE-2010-4172 20101122 [SECURITY] CVE-2010-4172: Apache Tomcat Manager application XSS vulnerability  View
87326 15457 CVE-2010-4172 45015  View
87327 15457 CVE-2010-4172 USN-1048-1  View
87328 15457 CVE-2010-4172 ADV-2010-3047  View
87329 15457 CVE-2010-4172 ADV-2011-0203  View
87330 15457 CVE-2010-4172 tomcat-sessionlist-xss(63422)  View
87331 15457 CVE-2010-4172 https://bugzilla.redhat.com/show_bug.cgi?id=656246  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
36751 JVNDB-2010-002531 Apache Tomcat の Manager アプリケーションにおけるクロスサイトスクリプティングの脆弱性 Apache Tomcat の Manager アプリケーションには、sessionsList.jsp および sessionDetail.jsp の orderBy または sort に関する処理に不備があるため、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2010-4172 46752 CVE-2010-4172 15457 4.3 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-002531.html 2010-11-22 2015-03-26 View