Description
Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | tomcat5.5 | 5.5.26-5lenny2 | DSA-2207-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | tomcat5 +10 | 5.5.23-0jpp.7.el5_3.2 | RHSA-2009:1164 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Server 2 | tomcat5 +10 | 5.5.23-0jpp_4rh.16 | RHSA-2009:1562 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 4.1.0, <= 4.1.39 | — | GHSA-j788-fx57-99wp |
| Maven | org.apache.tomcat:tomcat | >= 5.5.0, <= 5.5.27 | — | GHSA-j788-fx57-99wp |
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, < 6.0.20 | 6.0.20 | GHSA-j788-fx57-99wp |
Advisories 3
- RHSA-2009:1164 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2207-1 tomcat5.5 - several Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2009:1562 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- http://tomcat.apache.org/security-4.html
- HPSBMA02535 vendor-advisory
- MDVSA-2009:138 vendor-advisory
- oval:org.mitre.oval:def:6564 vdb-entry signature
- FEDORA-2009-11356 vendor-advisory
- DSA-2207 vendor-advisory
- HPSBUX02860 vendor-advisory
- tomcat-cal2-xss(49213) vdb-entry
- 37460 third-party-advisory
- ADV-2010-3056 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- 35788 third-party-advisory
- APPLE-SA-2010-03-29-1 vendor-advisory
- HPSBOV02762 vendor-advisory
- ADV-2009-1856 vdb-entry
- oval:org.mitre.oval:def:11041 vdb-entry signature
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- 42368 third-party-advisory
- http://tomcat.apache.org/security-6.html
- http://support.apple.com/kb/HT4077
- FEDORA-2009-11374 vendor-advisory
- 35685 third-party-advisory
- oval:org.mitre.oval:def:19345 vdb-entry signature
- FEDORA-2009-11352 vendor-advisory
- http://tomcat.apache.org/security-5.html
- SUSE-SR:2009:012 vendor-advisory
- HPSBUX02579 vendor-advisory
- MDVSA-2009:136 vendor-advisory
- 263529 vendor-advisory
- ADV-2009-3316 vdb-entry
- 20090306 [SECURITY] CVE-2009-0781 XSS in Apache Tomcat examples web application mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ mailing-list