CVE-2003-0044: Jakarta Tomcat Cross-Site Scripting (XSS) Vulnerability
Summary
CVE-2003-0044: Jakarta Tomcat cross-site scripting (XSS) vulnerability. Affects org.apache.tomcat:tomcat versions >= 3.0, < 3.3.2. Fixed in 3.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jakarta Tomcat is an open-source web server and servlet container that implements the Java Servlet, JavaServer Pages (JSP), and WebSocket technologies. It provides a platform for running Java web applications. The vulnerability in Jakarta Tomcat allows remote attackers to insert arbitrary web script or HTML, leading to potential cross-site scripting (XSS) attacks.
Vulnerability Detail
The Jakarta Tomcat vulnerability (CVE-2003-0044) is a cross-site scripting (XSS) vulnerability that affects the examples and ROOT web applications. This vulnerability allows remote attackers to inject malicious web script or HTML code into the affected applications. The impact of this vulnerability can range from unauthorized access to sensitive information to the execution of arbitrary code on the client-side. The vulnerability is considered moderate in severity (CWE-79).
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Jakarta Tomcat is not immediately feasible, a temporary workaround is to disable or restrict access to the affected examples and ROOT web applications. This can be done by modifying the server configuration to remove or restrict access to these applications. However, this workaround should be considered temporary, and upgrading to the latest version is still recommended for a comprehensive fix.
Conclusion
The Jakarta Tomcat XSS vulnerability (CVE-2003-0044) is a moderate-severity vulnerability that allows remote attackers to inject malicious web script or HTML code. To mitigate this vulnerability, it is recommended to upgrade Jakarta Tomcat to version 3.3.2 or later. If immediate upgrade is not possible, disabling or restricting access to the affected applications can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
The vulnerability allows remote attackers to inject malicious web script or HTML code into the affected applications, potentially leading to unauthorized access to sensitive information or the execution of arbitrary code on the client-side.
The vulnerability affects Jakarta Tomcat versions 3.x through 3.3.1a.
While there may not be a specific known exploit for this vulnerability, it is important to address it promptly to prevent potential attacks.
A temporary workaround is to disable or restrict access to the affected examples and ROOT web applications. However, upgrading to the latest version is still recommended for a comprehensive fix.
You can find more information about the vulnerability in the CVE-2003-0044 advisory and the GitHub advisory database.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
