Detections
Analytics
Apache Tomcat DOS Device Name XSS
medium Nessus Plugin ID 11042
Language:
Synopsis
The remote web server is affected by a cross-site scripting issue.Description
Apache Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies.By making requests for DOS Device names it is possible to cause Tomcat to throw an exception, allowing cross-site scripting attacks. The exception also reveals the physical path of the Tomcat installation.
Solution
Upgrade to Apache Tomcat v4.1.3 beta or later.See Also
Plugin Details
Severity: Medium
ID: 11042
File Name: apache_Tomcat_DOS_Device_XSS.nasl
Version: 1.35
Type: remote
Family: CGI abuses : XSS
Published: 7/10/2002
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Vulnerability Information
CPE: cpe:/a:apache:tomcat
Required KB Items: www/tomcat
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 7/10/2002
Reference Information
BID: 5194