CVE-2008-1232: Apache Tomcat Cross-site scripting (XSS) vulnerability
Summary
CVE-2008-1232: Apache Tomcat Cross-site scripting (XSS) vulnerability. Affects org.apache.tomcat:tomcat across 3 version ranges.
>= 4.1.0, < 4.1.38
>= 5.5.0, < 5.5.27
>= 6.0.0, < 6.0.17
Fixed in 4.1.38, 5.5.27 or 6.0.17, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. The vulnerability identified as CVE-2008-1232 is a cross-site scripting (XSS) vulnerability that affects Apache Tomcat versions 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16. This vulnerability allows remote attackers to inject arbitrary web script or HTML by exploiting a crafted string used in the message argument to the HttpServletResponse.sendError method.
Vulnerability Detail
The cross-site scripting (XSS) vulnerability in Apache Tomcat allows attackers to inject malicious code into web pages viewed by other users. By exploiting this vulnerability, an attacker can execute arbitrary scripts or HTML code in the context of the vulnerable application. This can lead to various security risks, such as stealing sensitive information, session hijacking, or defacing the affected website. The vulnerability is caused by improper input validation and sanitization of user-supplied data, which allows the injection of malicious code.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.1.0, < 4.1.384.1.38 -
>= 5.5.0, < 5.5.275.5.27 -
>= 6.0.0, < 6.0.176.0.17
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately possible, a temporary workaround can be implemented. One possible workaround is to sanitize and validate all user-supplied input before using it in the HttpServletResponse.sendError method. This can be done by implementing input validation and output encoding techniques to prevent the execution of malicious scripts or HTML code. It is recommended to consult the Apache Tomcat documentation and security guidelines for detailed instructions on implementing input validation and output encoding.
Conclusion
The cross-site scripting (XSS) vulnerability in Apache Tomcat can have serious security implications, allowing attackers to inject malicious code into web pages viewed by other users. It is crucial to promptly upgrade to a fixed version of Apache Tomcat and implement proper input validation and output encoding techniques to mitigate the risk of XSS attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts or HTML code into web pages viewed by other users. This can lead to various security risks, such as stealing sensitive information, session hijacking, or defacing the affected website.
The vulnerability affects Apache Tomcat versions 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16.
The potential risks of this vulnerability include the execution of arbitrary scripts or HTML code in the context of the vulnerable application, leading to stealing sensitive information, session hijacking, or defacing the affected website.
To mitigate the risk of this vulnerability, it is recommended to upgrade to a fixed version of Apache Tomcat and keep the installation up to date with the latest security patches. Implementing input validation and output encoding techniques can also help prevent the execution of malicious scripts or HTML code.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
