Apache Tomcat "host-manager/html/add文件" 跨站脚本漏洞

<a href="https://www.securityfocus.com/bid/29502" target="_blank">https://www.securityfocus.com/bid/29502</a><br/> <a href="https://cxsecurity.com/issue/WLB-2008060008" target="_blank">https://cxsecurity.com/issue/WLB-2008060008</a><br/> <a href="http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200806-068" target="_blank">http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200806-068</a><br/>

ApacheTomcat是一个流行的开放源码的JSP应用服务器程序。ApacheTomcat的host-manager/html/add文件没有正确地过滤对name参数的输入便返回给了用户，远程攻击者可以通过跨站脚本攻击在登录用户浏览器会话中执行任意HTML和脚本代码。

来源:FEDORA
名称:FEDORA-2008-8130
链接:https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00889.html
来源:FEDORA
名称:FEDORA-2008-8113
链接:https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00859.html
来源:FEDORA
名称:FEDORA-2008-7977
链接:https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00712.html
来源:XF
名称:apache-tomcat-hostmanager-xss(42816)
链接:http://xforce.iss.net/xforce/xfdb/42816
来源:VUPEN
名称:ADV-2009-0503
链接:http://www.vupen.com/english/advisories/2009/0503
来源:www.vmware.com
链接:http://www.vmware.com/security/advisories/VMSA-2009-0002.html
来源:SECTRACK
名称:1020624
链接:http://www.securitytracker.com/id?1020624
来源:BID
名称:31681
链接:http://www.securityfocus.com/bid/31681
来源:BID
名称:29502
链接:http://www.securityfocus.com/bid/29502
来源:BUGTRAQ
名称:20080602[SECURITY]CVE-2008-1947:Tomcathost-managerXSSvulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/492958/100/0/threaded
来源:REDHAT
名称:RHSA-2008:0864
链接:http://www.redhat.com/su