Date: Sat, 21 Jul 2007 19:51:11 -0400
From: Mark Thomas <markt@apache.org.>
To: Tomcat Users List <users@tomcat.apache.org.>,
Subject: CVE-2007-3383: XSS in Tomcat send mail example
X-Enigmail-Version: 0.95.2
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: antivirus-gw at tyumen.ru
CVE-2007-3383: XSS in Tomcat send mail example
Severity:
Low (Cross-site scripting)
Vendor:
The Apache Software Foundation
Versions Affected:
4.0.0 to 4.0.6
4.1.0 to 4.1.36
Description:
When reporting error messages, the SendMailServlet does not filter
user supplied data before display. This enables an XSS attack.
Mitigation:
Undeploy the examples web application.
Credit:
This issue was discovered by Tomasz Kuczynski, Poznan Supercomputing
and Networking Center, who worked with the CERT/CC to report the
vulnerability.
Example:
On this page
http://localhost:8080/examples/jsp/mail/sendmail.jsp
enter the following text
<script>alert('XSS reflected')</script>
in the From field and click Send.
References:
http://tomcat.apache.org/security.html
Mark Thomas
