CVE-2007-1358: Apache Tomcat XSS In Accept-Language Headers
Summary
CVE-2007-1358: Apache Tomcat XSS In Accept-Language Headers. Affects org.apache.tomcat:tomcat across 2 version ranges.
>= 4.0.0, <= 4.0.6
>= 4.1.0, <= 4.1.34
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to serve Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. The vulnerability affects Apache Tomcat versions 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34. This vulnerability allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language" headers that do not conform to RFC 2616.
Vulnerability Detail
The vulnerability in Apache Tomcat is a cross-site scripting (XSS) vulnerability. It occurs when certain applications using Apache Tomcat accept "Accept-Language" headers that do not conform to RFC 2616. Remote attackers can exploit this vulnerability to inject arbitrary web script or HTML into the affected application. This can lead to various security risks, including the execution of malicious code, session hijacking, and information disclosure.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to a patched version is not immediately possible, a temporary workaround is to implement input validation and sanitization measures in the application code. This can include filtering and escaping user input to prevent the execution of malicious scripts. It is also recommended to enforce strict adherence to the RFC 2616 specification for "Accept-Language" headers.
Conclusion
The XSS vulnerability in Apache Tomcat can have serious security implications for affected applications. It is crucial to promptly apply the recommended security patches or upgrade to a patched version of Apache Tomcat. Additionally, implementing proper input validation and sanitization measures can help mitigate the risk of XSS attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to serve Java-based web applications.
The vulnerability affects Apache Tomcat versions 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34.
The vulnerability allows remote attackers to inject arbitrary web script or HTML into the affected application, leading to various security risks such as the execution of malicious code, session hijacking, and information disclosure.
To fix this vulnerability, it is recommended to upgrade to a patched version of Apache Tomcat and ensure proper input validation and sanitization in the application code.
A temporary workaround is to implement input validation and sanitization measures in the application code and enforce strict adherence to the RFC 2616 specification for "Accept-Language" headers.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
