Apache Tomcat 'Cal2.JSP' 跨站脚本攻击漏洞

<a href="https://www.exploit-db.com/exploits/30563" target="_blank">https://www.exploit-db.com/exploits/30563</a><br/> <a href="http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200705-153" target="_blank">http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200705-153</a><br/>

ApacheTomcat的日历应用程序例子中存在跨站脚本攻击漏洞。远程攻击者可以借助提交到cal2.jsp的时间参数和其他未明参数，注入任意的web脚本或HTML。注意：此漏洞可能与CVE-2006-0254.1有关。

来源:VUPEN
名称:ADV-2007-1729
链接:http://www.frsirt.com/english/advisories/2007/1729
来源:BID
名称:25531
链接:http://www.securityfocus.com/bid/25531
来源:BUGTRAQ
名称:20090127CA20090123-01:CohesionTomcatMultipleVulnerabilities(Updated-v1.1)
链接:http://www.securityfocus.com/archive/1/archive/1/500412/100/0/threaded
来源:BUGTRAQ
名称:20090124CA20090123-01:CohesionTomcatMultipleVulnerabilities
链接:http://www.securityfocus.com/archive/1/archive/1/500396/100/0/threaded
来源:BUGTRAQ
名称:20070905Re:Apachetomcatcalendarexamplecrosssitescriptingandcrosssiterequestforgeryvulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/478609/100/0/threaded
来源:BUGTRAQ
名称:20070904Apachetomcatcalendarexamplecrosssitescriptingandcrosssiterequestforgeryvulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/478491/100/0/threaded
来源:VUPEN
名称:ADV-2009-0233
链接:http://www.frsirt.com/english/advisories/2009/0233
来源:tomcat.apache.org
链接:http://tomcat.apache.org/security-5.html
来源:tomcat.apache.org
链接:http://tomcat.apa