CVE-2011-0013: Apache Tomcat HTML Manager Interface XSS Vulnerability
Summary
CVE-2011-0013: Improper Neutralization of Input During Web Page Generation in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
>= 5.5.0, < 5.5.32
>= 6.0.0, < 6.0.30
>= 7.0.0, < 7.0.6
Fixed in 5.5.32, 6.0.30 or 7.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a web-based management interface called the HTML Manager Interface, which allows administrators to monitor and manage Tomcat instances. This vulnerability affects Apache Tomcat versions 5.5 to 5.5.32, 6.0 to 6.0.30, and 7.0 to 7.0.6. The HTML Manager Interface is susceptible to multiple cross-site scripting (XSS) vulnerabilities, which can be exploited by remote attackers to inject arbitrary web script or HTML. These vulnerabilities are demonstrated through the manipulation of the display-name tag.
Vulnerability Detail
The XSS vulnerabilities in the Apache Tomcat HTML Manager Interface can have serious consequences. By injecting malicious script or HTML, attackers can manipulate the behavior of the web application, steal sensitive information, or perform unauthorized actions on behalf of the user. The vulnerabilities arise due to improper neutralization of user-supplied input during web page generation. This allows attackers to bypass input validation and inject malicious code into the generated HTML pages. The impact of these vulnerabilities can vary depending on the specific context in which they are exploited.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.5.0, < 5.5.325.5.32 -
>= 6.0.0, < 6.0.306.0.30 -
>= 7.0.0, < 7.0.67.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a patched version is not immediately feasible, a possible workaround is to restrict access to the HTML Manager Interface. This can be done by modifying the Tomcat configuration to limit access to trusted IP addresses or by disabling the HTML Manager Interface altogether. However, it is important to note that this workaround may impact the functionality and management capabilities of the Tomcat instance.
Conclusion
The XSS vulnerabilities in the Apache Tomcat HTML Manager Interface pose a significant risk to the security and integrity of web applications deployed on affected versions of Apache Tomcat. It is crucial to promptly upgrade to the patched versions or implement the recommended workaround to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications.
The HTML Manager Interface is a web-based management interface provided by Apache Tomcat. It allows administrators to monitor and manage Tomcat instances.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The XSS vulnerabilities in Apache Tomcat can be exploited by attackers to manipulate the behavior of the web application, steal sensitive information, or perform unauthorized actions on behalf of the user.
To fix the XSS vulnerabilities, it is recommended to upgrade to a patched version of Apache Tomcat. Users of Apache Tomcat 5.5 should upgrade to version 5.5.32, users of Apache Tomcat 6.0 should upgrade to version 6.0.30, and users of Apache Tomcat 7.0 should upgrade to version 7.0.6.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
