Apache Tomcat 'sort'和'orderBy'参数跨站脚本攻击漏洞

<a href="https://www.exploit-db.com/exploits/35011" target="_blank">https://www.exploit-db.com/exploits/35011</a><br/> <a href="https://www.securityfocus.com/bid/45015" target="_blank">https://www.securityfocus.com/bid/45015</a><br/> <a href="http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201011-243" target="_blank">http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201011-243</a><br/>

ApacheTomcat是一款开放源码的JSP应用服务器程序。由于受影响的会话列表屏幕(由sessionList.jsp脚本提供)没有采用任何过滤使用orderBy和sort请求，因此可造成跨站脚本攻击。用户必须注意Tomcat6默认没有把会话COOKIE设置httpOnly，否则攻击者可利用此漏洞获得会话COOKIE。

来源:bugzilla.redhat.com
链接:https://bugzilla.redhat.com/show_bug.cgi?id=656246
来源:VUPEN
名称:ADV-2010-3047
链接:http://www.vupen.com/english/advisories/2010/3047
来源:BID
名称:45015
链接:http://www.securityfocus.com/bid/45015
来源:BUGTRAQ
名称:20101122[SECURITY]CVE-2010-4172:ApacheTomcatManagerapplicationXSSvulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/514866/100/0/threaded
来源:tomcat.apache.org
链接:http://tomcat.apache.org/security-7.html
来源:tomcat.apache.org
链接:http://tomcat.apache.org/security-6.html
来源:svn.apache.org
链接:http://svn.apache.org/viewvc?view=revision&revision=1037779
来源:svn.apache.org
链接:http://svn.apache.org/viewvc?view=revision&revision=1037778
来源:SECTRACK
名称:1024764
链接:http://securitytracker.com/id?1024764
来源:SECUNIA
名称:42337
链接:http://secunia.com/advisories/42337
来源:FULLDISC
名称:20101122[SECURITY]CVE-2010-4172:ApacheTomcatManagerapplicationXSSvulnerability
链接:http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0285.html