CVE-2002-1567 - Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arb

CVE-2002-1567

Summary

Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.

References

Vulnerable Configurations

cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 25-03-2019 - 11:29)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

confirm	http://tomcat.apache.org/security-4.html
mlist	[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
vuln-dev	20020821 Apache Tomcat 4.1 Cross-Site Scripting Vulnerability

Last major update

25-03-2019 - 11:29

Published

06-10-2003 - 04:00

Last modified

25-03-2019 - 11:29