Description
Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | jakarta-commons-modeler +1 | 1.1-8jpp.1.0.2.el5 | RHSA-2007:0327 |
| RHEL 5 | tomcat5 +10 | 5.5.23-0jpp.1.0.3.el5 | RHSA-2007:0327 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Developer Suite 3 | jakarta-commons-modeler | 2.0-3jpp_3rh | RHSA-2007:0328 |
| Red Hat Rhel Developer Suite 3 | tomcat5 +5 | 5.5.23-0jpp_6rh | RHSA-2007:0328 |
| Red Hat Rhel Application Server 2 | jakarta-commons-modeler +1 | 2.0-3jpp_2rh | RHSA-2007:0326 |
| Red Hat Rhel Application Server 2 | tomcat5 +10 | 5.5.23-0jpp_4rh.3 | RHSA-2007:0326 |
| Red Hat Rhel Application Server 1 | tomcat5 +2 | 5.0.30-0jpp_5rh | RHSA-2007:0340 |
| Red Hat Network Satellite 5 | jabberd | 2.0s10-3.38.rhn | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | openmotif21 | 2.1.30-11.RHEL4.6 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | perl-Crypt-CBC | 2.24-1.el4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-apache | 1.3.27-36.rhn.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modperl | 1.29-16.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | rhn-modssl | 2.8.12-8.rhn.10.rhel4 | RHSA-2008:0261 |
| Red Hat Network Satellite 5 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0261 |
| Red Hat Network Satellite 4 | jabberd | 2.0s10-3.37.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | java-1.4.2-ibm +1 | 1.4.2.10-1jpp.2.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | jfreechart | 0.9.20-3.rhn | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | openmotif21 | 2.1.30-9.RHEL3.8 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | perl-Crypt-CBC | 2.24-1.el3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-apache | 1.3.27-36.rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modjk-ap13 | 1.2.23-2rhn.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modperl | 1.29-16.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | rhn-modssl | 2.8.12-8.rhn.10.rhel3 | RHSA-2008:0524 |
| Red Hat Network Satellite 4 | tomcat5 | 5.0.30-0jpp_10rh | RHSA-2008:0524 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 5.0.0, <= 5.0.30 | — | GHSA-p57v-p3fx-qgwm |
| Maven | org.apache.tomcat:tomcat | >= 5.5.0, < 5.5.18 | 5.5.18 | GHSA-p57v-p3fx-qgwm |
Advisories 6
- RHSA-2008:0524 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0261 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0327 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0326 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Jan 7, 2026
- RHSA-2007:0340 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Jan 7, 2026
- RHSA-2007:0328 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- [Security-announce] 20080107 VMSA-2008-0002 Low severity security update for VirtualCenter and ESX Server 3.0.2, and ESX 3.0.1 mailing-list
- 28481 vdb-entry
- ADV-2008-0065 vdb-entry
- 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1) mailing-list
- 33668 third-party-advisory
- 20080108 VMSA-2008-0002 Low severity security update for VirtualCenter and ESX Server 3.0.2, and ESX 3.0.1 mailing-list
- 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities mailing-list
- ADV-2007-1729 vdb-entry
- ADV-2009-0233 vdb-entry
- 28365 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm
- RHSA-2007:0327 vendor-advisory
- http://tomcat.apache.org/security-5.html
- oval:org.mitre.oval:def:10514 vdb-entry signature
- RHSA-2008:0261 vendor-advisory
- http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
- http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540