Description
Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp. NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Server 1 | tomcat5 +2 | 5.0.30-0jpp_5rh | RHSA-2007:0340 |
| Red Hat Network Satellite 5 | jabberd | 2.0s10-3.38.rhn | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0630, RHSA-2008:0261 |
| Red Hat Network Satellite 5 | mod_perl | 2.0.2-12.el4 | RHSA-2008:0630 |
| Red Hat Network Satellite 5 | openmotif21 | 2.1.30-11.RHEL4.6 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | perl-Crypt-CBC | 2.24-1.el4 | RHSA-2008:0630, RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-apache | 1.3.27-36.rhn.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-html | 5.1.1-7 | RHSA-2008:0630 |
| Red Hat Network Satellite 5 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modperl | 1.29-16.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modssl | 2.8.12-8.rhn.10.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0630, RHSA-2008:0261 |
| Red Hat Network Satellite 4 | jabberd | 2.0s10-3.37.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | openmotif21 | 2.1.30-9.RHEL3.8 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | perl-Crypt-CBC | 2.24-1.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-apache | 1.3.27-36.rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modperl | 1.29-16.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modssl | 2.8.12-8.rhn.10.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0524 |
Advisories 4
- RHSA-2008:0524 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0261 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0340 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Jan 7, 2026
- RHSA-2008:0630 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- http://tomcat.apache.org/security-4.html
- tomcat-functions-xss(36467) vdb-entry
- 20070906 Apache Tomcat remote xss mailing-list
- RHSA-2008:0630 vendor-advisory
- 34878 vdb-entry
- 12721 vdb-entry
- 31493 third-party-advisory
- [tomcat-dev] 20050103 [PATCH jakarta-servletapi-5] Re: Fwd: XSS in Jakarta Tomcat 5.5.6 mailing-list
- 34879 vdb-entry
- 1012793 vdb-entry
- 13737 third-party-advisory
- http://www.oliverkarow.de/research/jakarta556_xss.txt
- http://tomcat.apache.org/security-5.html
- RHSA-2008:0261 vendor-advisory
- [tomcat-dev] 20050103 Re: Fwd: XSS in Jakarta Tomcat 5.5.6 mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ mailing-list