Description
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | tomcat5 +10 | 5.5.23-0jpp.7.el5_2.1 | RHSA-2008:0648 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Developer Suite 3 | tomcat5 +5 | 5.5.23-0jpp_12rh | RHSA-2008:0864 |
| Red Hat Rhel Application Server 2 | tomcat5 +10 | 5.5.23-0jpp_4rh.9 | RHSA-2008:0862 |
| Red Hat Network Satellite 5 | tomcat5 | 5.0.30-0jpp_12rh | RHSA-2008:1007 |
| Red Hat JBoss EAP 4 | jbossweb | 2.0.0-5.CP07.0jpp.ep1.1.el4 | RHSA-2008:0877 |
| Red Hat Certificate System 7 | ant | 1.6.5-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | avalon-logkit | 1.2-2jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | axis | 1.2.1-1jpp_3rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-jaf | 1.0-2jpp_6rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-mail | 1.1.1-2jpp_8rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | geronimo-specs +10 | 1.0-0.M4.1jpp_10rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | jakarta-commons-modeler | 2.0-3jpp_2rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | log4j | 1.2.12-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | mx4j | 1:3.0.1-1jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | pcsc-lite +2 | 1.3.3-3.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-ca | 7.3.0-20.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-java-tools | 7.3.0-10.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-kra | 7.3.0-14.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-manage | 7.3.0-19.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-native-tools | 7.3.0-6.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-tks +1 | 7.3.0-13.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | tomcat5 +5 | 5.5.23-0jpp_4rh.16 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xerces-j2 | 2.7.1-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xml-commons +1 | 1.3.02-2jpp_1rh | RHSA-2010:0602 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Apache Tomcat 6.0.16 - 'HttpServletResponse.sendError()' Cross-Site Scripting EDB-32138 · remote · Aug 1, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 4.1.0, < 4.1.38 | 4.1.38 | GHSA-q74x-qqhr-f8rx |
| Maven | org.apache.tomcat:tomcat | >= 5.5.0, < 5.5.27 | 5.5.27 | GHSA-q74x-qqhr-f8rx |
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, < 6.0.17 | 6.0.17 | GHSA-q74x-qqhr-f8rx |
Advisories 6
- RHSA-2010:0602 Red Hat Security Advisory: Red Hat Certificate System 7.3 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0648 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:1007 Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0864 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0877 Red Hat Security Advisory: jbossweb security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0862 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 1020622 vdb-entry
- oval:org.mitre.oval:def:5985 vdb-entry signature
- http://tomcat.apache.org/security-4.html
- RHSA-2008:0862 vendor-advisory
- ADV-2009-1609 vdb-entry
- ADV-2009-2194 vdb-entry
- 34013 third-party-advisory
- http://community.ca.com/blogs/casecurityresponseblog/archive/2009/06/15/ca20090615-02-ca-service-desk-tomcat-cross-site-scripting-vulnerability.aspx
- ADV-2008-2823 vdb-entry
- 37460 third-party-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0002.html
- 31982 third-party-advisory
- 31681 vdb-entry
- 32120 third-party-advisory
- oval:org.mitre.oval:def:11181 vdb-entry signature
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- 33999 third-party-advisory
- 30496 vdb-entry
- 31865 third-party-advisory
- 4098 third-party-advisory
- FEDORA-2008-8130 vendor-advisory
- https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=214095
- 31639 third-party-advisory
- SUSE-SR:2008:018 vendor-advisory
- 36108 third-party-advisory
- MDVSA-2008:188 vendor-advisory
- 31379 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm
- ADV-2009-0320 vdb-entry
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- RHSA-2008:0864 vendor-advisory
- SUSE-SR:2009:004 vendor-advisory
- http://tomcat.apache.org/security-6.html
- 57126 third-party-advisory
- 32222 third-party-advisory
- 31891 third-party-advisory
- 33797 third-party-advisory
- https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=209500
- 20090806 CA20090806-02: Security Notice for Unicenter Asset Portfolio Management, Unicenter Desktop and Server Management, Unicenter Patch Management mailing-list
- FEDORA-2008-7977 vendor-advisory
- ADV-2008-2305 vdb-entry
- FEDORA-2008-8113 vendor-advisory
- 20090616 CA20090615-02: CA Service Desk Tomcat Cross Site Scripting Vulnerability mailing-list
- http://tomcat.apache.org/security-5.html
- 35474 third-party-advisory
- ADV-2008-2780 vdb-entry
- 31381 third-party-advisory
- HPSBUX02401 vendor-advisory
- HPSBST02955 vendor-advisory
- APPLE-SA-2008-10-09 vendor-advisory
- http://support.apple.com/kb/HT3216
- ADV-2009-0503 vdb-entry
- ADV-2009-3316 vdb-entry
- tomcat-httpservletresponse-xss(44155) vdb-entry
- 20080801 [CVE-2008-1232] Apache Tomcat XSS vulnerability mailing-list
- 32266 third-party-advisory
- RHSA-2008:0648 vendor-advisory
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list