Description
Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | tomcat5.5 | 5.5.20-2etch3 | DSA-1593-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | tomcat5 +10 | 5.5.23-0jpp.7.el5_2.1 | RHSA-2008:0648 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Developer Suite 3 | tomcat5 +5 | 5.5.23-0jpp_12rh | RHSA-2008:0864 |
| Red Hat Rhel Application Server 2 | tomcat5 +10 | 5.5.23-0jpp_4rh.9 | RHSA-2008:0862 |
| Red Hat Network Satellite 5 | tomcat5 | 5.0.30-0jpp_12rh | RHSA-2008:1007 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 5.5.9, < 5.5.27 | 5.5.27 | GHSA-f98p-9pp6-7q6c |
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, < 6.0.18 | 6.0.18 | GHSA-f98p-9pp6-7q6c |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 5.5.9, < 5.5.27 | 5.5.27 | GHSA-f98p-9pp6-7q6c |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 6.0.0, < 6.0.18 | 6.0.18 | GHSA-f98p-9pp6-7q6c |
Advisories 5
- RHSA-2008:0648 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1593-1 tomcat5.5 Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2008:1007 Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0864 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0862 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 20080602 [SECURITY] CVE-2008-1947: Tomcat host-manager XSS vulnerability mailing-list
- 30500 third-party-advisory
- RHSA-2008:0862 vendor-advisory
- 34013 third-party-advisory
- [tomcat-user] 20080602 [SECURITY] CVE-2008-1947: Tomcat host-manager XSS vulnerability mailing-list
- oval:org.mitre.oval:def:6009 vdb-entry signature
- ADV-2008-2823 vdb-entry
- apache-tomcat-hostmanager-xss(42816) vdb-entry
- 37460 third-party-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0002.html
- 31681 vdb-entry
- 32120 third-party-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- ADV-2008-1725 vdb-entry
- 30592 third-party-advisory
- 33999 third-party-advisory
- oval:org.mitre.oval:def:11534 vdb-entry signature
- 29502 vdb-entry
- 31865 third-party-advisory
- FEDORA-2008-8130 vendor-advisory
- 31639 third-party-advisory
- 30967 third-party-advisory
- MDVSA-2008:188 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm
- ADV-2009-0320 vdb-entry
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- RHSA-2008:0864 vendor-advisory
- SUSE-SR:2009:004 vendor-advisory
- http://tomcat.apache.org/security-6.html
- 57126 third-party-advisory
- 32222 third-party-advisory
- 31891 third-party-advisory
- 33797 third-party-advisory
- 1020624 vdb-entry
- SUSE-SR:2008:014 vendor-advisory
- FEDORA-2008-7977 vendor-advisory
- FEDORA-2008-8113 vendor-advisory
- http://tomcat.apache.org/security-5.html
- ADV-2008-2780 vdb-entry
- HPSBUX02401 vendor-advisory
- HPSBST02955 vendor-advisory
- APPLE-SA-2008-10-09 vendor-advisory
- http://support.apple.com/kb/HT3216
- ADV-2009-0503 vdb-entry
- ADV-2009-3316 vdb-entry
- DSA-1593 vendor-advisory
- 32266 third-party-advisory
- RHSA-2008:0648 vendor-advisory
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ mailing-list