Apache Tomcat Manager和Host Manage跨站脚本执行漏洞

<a href="https://www.securityfocus.com/bid/24475" target="_blank">https://www.securityfocus.com/bid/24475</a><br/> <a href="https://cxsecurity.com/issue/WLB-2007060074" target="_blank">https://cxsecurity.com/issue/WLB-2007060074</a><br/> <a href="http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200706-259" target="_blank">http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200706-259</a><br/>

ApacheTomcat是一个流行的开放源码的JSP应用服务器程序。ApacheTomcat的某些应用存在输入验证漏洞，远程攻击者可能利用此漏洞执行跨站脚本执行攻击。ApacheTomcat的Manager和HostManagerWeb应用没有对表单字段参数的输入进行转义，允许通过认证的攻击者通过manager/html/upload的参数名注入任意Web脚本或HTML，执行跨站脚本攻击。

来源:tomcat.apache.org
链接:http://tomcat.apache.org/security-6.html
来源:FEDORA
名称:FEDORA-2007-3456
链接:https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html
来源:XF
名称:tomcat-hostmanager-xss(34868)
链接:http://xforce.iss.net/xforce/xfdb/34868
来源:SECTRACK
名称:1018245
链接:http://www.securitytracker.com/id?1018245
来源:BID
名称:24475
链接:http://www.securityfocus.com/bid/24475
来源:BUGTRAQ
名称:20090127CA20090123-01:CohesionTomcatMultipleVulnerabilities(Updated-v1.1)
链接:http://www.securityfocus.com/archive/1/archive/1/500412/100/0/threaded
来源:BUGTRAQ
名称:20090124CA20090123-01:CohesionTomcatMultipleVulnerabilities
链接:http://www.securityfocus.com/archive/1/archive/1/500396/100/0/threaded
来源:BUGTRAQ
名称:20070614[CVE-2007-2450]:ApacheTomcatXSSvulnerabilityinManager
链接:http://www.securityfocus.com/archive/1/archive/1/471357/100/0/threaded
来源:REDHAT
名称:RHSA-2007:0569
链接:http://www.redhat.com/support/errata/RHSA-2007-0569.html
来源:OSVDB
名称:36079
链接:http://www.osvdb.org/36079
来源:VUPEN
名称:A