CVE-2011-0013 — Improper Neutralization of Input During Web Page Generation in Apache Tomcat

Description

Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 6.0	tomcat6	6.0.28-9+squeeze1	DSA-2160-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 6	tomcat6 +8	6.0.24-33.el6	RHSA-2011:0791
RHEL 5	tomcat5 +10	5.5.23-0jpp.22.el5_7	RHSA-2011:1845

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat JBoss Web Server 1	ant	1.7.1-13.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	ant-commons-net	1.7.1-14.ep5.el6	RHSA-2011:0897
Red Hat JBoss Web Server 1	ant-jmf +16	1.7.1-13.jdk6.ep5.el5	RHSA-2011:0897
Red Hat JBoss Web Server 1	antlr	2.7.7-7.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	bcel	5.2-8.1.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	cglib	2.2-5.1.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	dom4j	1.6.1-11.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	ecj	1:3.3.1.1-3.2.2.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	ecj3	1:3.3.1.1-3.1.1.1.jdk6.ep5.el5	RHSA-2011:0897
Red Hat JBoss Web Server 1	glassfish-jaf	1.1.0-6.1.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	glassfish-javamail	1.4.2-0.4.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	glassfish-jsf	1.2_13-2.2.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	hibernate3 +1	1:3.3.2-1.4.GA_CP04.ep5.el5	RHSA-2011:0897
Red Hat JBoss Web Server 1	hibernate3-annotations +1	3.4.0-3.2.GA_CP04.ep5.el5	RHSA-2011:0897
Red Hat JBoss Web Server 1	hibernate3-commons-annotations +1	3.1.0-1.8.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	hibernate3-ejb-persistence-3.0-api +1	1:1.0.2-3.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	hibernate3-entitymanager +1	3.4.0-4.3.GA_CP04.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	httpd +2	2.2.17-11.1.ep5.el5	RHSA-2011:0897
Red Hat JBoss Web Server 1	httpd-tools	2.2.17-11.2.ep5.el6	RHSA-2011:0897
Red Hat JBoss Web Server 1	httpd22 +6	2.2.17-14.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-beanutils	1.8.0-4.1.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-chain	1.2-2.2.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-codec	1.3-9.1.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-collections +1	3.2.1-4.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-daemon	1:1.0.5-1.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-daemon-jsvc	1:1.0.5-1.4.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-dbcp +1	1.2.1-16.2.ep5.el6	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-digester	1.8.1-8.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-el	1.0-19.2.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-fileupload	1:1.1.1-7.4.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-httpclient	1:3.1-1.1.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-io	1.4-1.3.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-launcher	1.1-4.6.1.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-logging +1	1.1.1-0.4.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-logging-jboss	1.1-10.2.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-modeler	2.0-4.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-pool +1	1.3-11.2.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-commons-validator	1.3.1-7.5.1.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-oro	2.0.8-3.3.2.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jakarta-taglibs-standard	1.1.1-9.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	javassist	3.12.0-1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jboss-common-core	2.2.17-1.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jboss-common-logging-jdk +1	2.1.2-1.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jboss-javaee +3	5.0.1-2.9.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jcommon	1.0.16-1.2.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	jfreechart	1.0.13-2.3.2.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	log4j	1.2.14-18.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	mod_cluster +5	1.0.10-2.GA_CP01.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	mod_jk +2	1.2.31-1.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	mod_ssl	1:2.2.17-11.1.ep5.el5	RHSA-2011:0897
Red Hat JBoss Web Server 1	mod_ssl22	1:2.2.17-14.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	mx4j	1:3.0.1-9.3.4.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	objectweb-asm	3.1-5.3.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	objectweb-asm31	3.1-12.1.ep5.el6	RHSA-2011:0897
Red Hat JBoss Web Server 1	regexp	1.5-1.2.1.jdk6.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	struts12	1.2.9-3.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	tomcat-jkstatus-ant	1.2.31-2.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	tomcat-native	1.1.20-2.0.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	tomcat5 +12	5.5.33-14_patch_04.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	tomcat6 +9	6.0.32-14_patch_03.ep5.el6	RHSA-2011:0897
Red Hat JBoss Web Server 1	xalan-j2	2.7.1-5.3_patch_04.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	xerces-j2	2.9.1-3.patch01.1.ep5.el4	RHSA-2011:0897
Red Hat JBoss Web Server 1	xml-commons +3	1.3.04-7.10.jdk6.ep5.el5	RHSA-2011:0897
Red Hat JBoss Web Server 1	xml-commons-which10 +4	1.3.04-7.14.ep5.el6	RHSA-2011:0897

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.tomcat:tomcat	>= 5.5.0, < 5.5.32	5.5.32	GHSA-3p86-xgrq-m6p6
Maven	org.apache.tomcat:tomcat	>= 6.0.0, < 6.0.30	6.0.30	GHSA-3p86-xgrq-m6p6
Maven	org.apache.tomcat:tomcat	>= 7.0.0, < 7.0.6	7.0.6	GHSA-3p86-xgrq-m6p6

Advisories 4

RHSA-2011:1845 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2011:0897 Red Hat Security Advisory: JBoss Enterprise Web Server 1.0.2 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2011:0791 Red Hat Security Advisory: tomcat6 security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
DSA-2160-1 tomcat6 - several Debian Security (DSA / DLA) · Mar 9, 2026

References

HPSBUX02860 vendor-advisory
oval:org.mitre.oval:def:12878 vdb-entry signature
ADV-2011-0376 vdb-entry
oval:org.mitre.oval:def:19269 vdb-entry signature
45022 third-party-advisory
RHSA-2011:1845 vendor-advisory
46174 vdb-entry
SUSE-SR:2011:005 vendor-advisory
SSRT100627 vendor-advisory
APPLE-SA-2011-10-12-3 vendor-advisory
MDVSA-2011:030 vendor-advisory
20110205 [SECURITY] CVE-2011-0013 Apache Tomcat Manager XSS vulnerability mailing-list
RHSA-2011:0897 vendor-advisory
57126 third-party-advisory
http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.32
RHSA-2011:0791 vendor-advisory
oval:org.mitre.oval:def:14945 vdb-entry signature
https://bugzilla.redhat.com/show_bug.cgi?id=675786
43192 third-party-advisory
http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.6_%28released_14_Jan_2011%29
1025026 vdb-entry
RHSA-2011:0896 vendor-advisory
DSA-2160 vendor-advisory
http://support.apple.com/kb/HT5002
8093 third-party-advisory
http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.30
HPSBUX02645 vendor-advisory
HPSBST02955 vendor-advisory
http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html
[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ mailing-list