NVD Vulnerability Detail

CVE-2008-1232

Summary	Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
Publication Date	Aug. 4, 2008, 10:41 a.m.
Registration Date	Jan. 29, 2021, 1:33 p.m.
Last Update	Feb. 13, 2023, 11:18 a.m.

CVSS2.0 : MEDIUM
Score	4.3
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	低
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	はい

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat::::::::	6.0.0	6.0.16
cpe:2.3:a:apache:tomcat::::::::	4.1.0	4.1.37
cpe:2.3:a:apache:tomcat::::::::	5.5.0	5.5.26

Related information, measures and tools

No	URL	refsource	タグ
1	http://tomcat.apache.org/security-4.html	CONFIRM	Vendor Advisory
2	http://tomcat.apache.org/security-5.html	CONFIRM	Vendor Advisory
3	http://tomcat.apache.org/security-6.html	CONFIRM	Vendor Advisory
4	http://www.securityfocus.com/bid/30496	BID	Exploit Patch Third Party Advisory VDB Entry
5	http://www.securitytracker.com/id?1020622	SECTRACK	Third Party Advisory VDB Entry
6	http://www.redhat.com/support/errata/RHSA-2008-0648.html	REDHAT	Third Party Advisory
7	http://secunia.com/advisories/31379	SECUNIA	Broken Link
8	http://secunia.com/advisories/31381	SECUNIA	Broken Link
9	http://www.mandriva.com/security/advisories?name=MDVSA-2008:188	MANDRIVA	Third Party Advisory
10	http://secunia.com/advisories/31639	SECUNIA	Broken Link
11	https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00889.html	FEDORA	Third Party Advisory
12	http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html	SUSE	Third Party Advisory
13	http://secunia.com/advisories/31891	SECUNIA	Broken Link
14	https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00859.html	FEDORA	Third Party Advisory
15	https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00712.html	FEDORA	Third Party Advisory
16	http://secunia.com/advisories/31865	SECUNIA	Broken Link
17	http://www.redhat.com/support/errata/RHSA-2008-0864.html	REDHAT	Third Party Advisory
18	http://www.redhat.com/support/errata/RHSA-2008-0862.html	REDHAT	Third Party Advisory
19	http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html	APPLE	Mailing List Third Party Advisory
20	http://www.securityfocus.com/bid/31681	BID	Third Party Advisory VDB Entry
21	http://secunia.com/advisories/32222	SECUNIA	Broken Link
22	http://support.apple.com/kb/HT3216	CONFIRM	Third Party Advisory
23	http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm	CONFIRM	Third Party Advisory
24	http://securityreason.com/securityalert/4098	SREASON	Third Party Advisory
25	http://secunia.com/advisories/31982	SECUNIA	Broken Link
26	http://marc.info/?l=bugtraq&m=123376588623823&w=2	HP	Mailing List Third Party Advisory
27	http://secunia.com/advisories/33797	SECUNIA	Broken Link
28	http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html	SUSE	Third Party Advisory
29	http://secunia.com/advisories/32120	SECUNIA	Broken Link
30	http://secunia.com/advisories/32266	SECUNIA	Broken Link
31	http://secunia.com/advisories/33999	SECUNIA	Broken Link
32	http://www.vmware.com/security/advisories/VMSA-2009-0002.html	CONFIRM	Third Party Advisory
33	http://www.vupen.com/english/advisories/2009/0503	VUPEN	URL Repurposed
34	http://secunia.com/advisories/34013	SECUNIA	Broken Link
35	http://community.ca.com/blogs/casecurityresponseblog/archive/2009/06/15/ca20090615-02-ca-service-desk-tomcat-cross-site-scripting-vulnerability.aspx	CONFIRM	Broken Link
36	http://secunia.com/advisories/35474	SECUNIA	Broken Link
37	https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=209500	CONFIRM	Broken Link
38	http://www.vupen.com/english/advisories/2009/1609	VUPEN	URL Repurposed
39	https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=214095	CONFIRM	Broken Link
40	http://secunia.com/advisories/36108	SECUNIA	Broken Link
41	http://www.vupen.com/english/advisories/2009/2194	VUPEN	URL Repurposed
42	http://secunia.com/advisories/37460	SECUNIA	Broken Link
43	http://www.vmware.com/security/advisories/VMSA-2009-0016.html	CONFIRM	Third Party Advisory
44	http://www.vupen.com/english/advisories/2009/3316	VUPEN	URL Repurposed
45	http://www.vupen.com/english/advisories/2008/2780	VUPEN	URL Repurposed
46	http://www.vupen.com/english/advisories/2009/0320	VUPEN	URL Repurposed
47	http://www.vupen.com/english/advisories/2008/2823	VUPEN	URL Repurposed
48	http://www.vupen.com/english/advisories/2008/2305	VUPEN	URL Repurposed
49	http://marc.info/?l=bugtraq&m=139344343412337&w=2	HP	Mailing List Third Party Advisory
50	http://secunia.com/advisories/57126	SECUNIA	Broken Link
51	https://exchange.xforce.ibmcloud.com/vulnerabilities/44155	XF	Third Party Advisory VDB Entry
52	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5985	OVAL	Tool Signature
53	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11181	OVAL	Tool Signature
54	http://www.securityfocus.com/archive/1/507985/100/0/threaded	BUGTRAQ	Third Party Advisory VDB Entry
55	http://www.securityfocus.com/archive/1/505556/100/0/threaded	BUGTRAQ	Third Party Advisory VDB Entry
56	http://www.securityfocus.com/archive/1/504351/100/0/threaded	BUGTRAQ	Third Party Advisory VDB Entry
57	http://www.securityfocus.com/archive/1/495021/100/0/threaded	BUGTRAQ	Third Party Advisory VDB Entry
58	https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E	MISC
59	https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E	MISC
60	https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E	MISC
61	https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E	MISC
62	https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E	MISC
63	https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E	MISC
64	https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E	MISC

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

Apache Tomcat の HttpServletResponse.sendError メソッドに関するクロスサイトスクリプティングの脆弱性

Title	Apache Tomcat の HttpServletResponse.sendError メソッドに関するクロスサイトスクリプティングの脆弱性
Summary	Apache Tomcat には、HttpServletResponse.sendError メソッドへの message 引数の取り扱いに不備があり、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	第三者により、任意の Web スクリプトまたは HTML を挿入される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 3, 2008, midnight
Registration Date	Sept. 3, 2008, 3:46 p.m.
Last Update	March 26, 2015, 5:55 p.m.

Affected System

サン・マイクロシステムズ

OpenSolaris (sparc)

OpenSolaris (x86)

Sun Solaris 10 (sparc)

Sun Solaris 10 (x86)

Sun Solaris 9 (sparc)

Sun Solaris 9 (x86)

レッドハット

Red Hat Enterprise Linux 5 (server)

Red Hat Enterprise Linux Desktop 5.0 (client)

RHEL Desktop Workstation 5 (client)

ヒューレット・パッカード

HP XP P9000 Performance Advisor ソフトウェア 5.4.1 未満

Apache Software Foundation

Apache Tomcat 4.1.0 から 4.1.37 のバージョン

Apache Tomcat 5.5.0 から 5.5.26 のバージョン

Apache Tomcat 6.0.0 から 6.0.16 のバージョン

サイバートラスト株式会社

Asianux Server 2.0

Asianux Server 2.1

Asianux Server 3 (x86)

Asianux Server 3 (x86-64)

アップル

Apple Mac OS X Server v10.5.5

VMware

VMware ESX 3.0.3

VMware ESX 3.5

VMware ESX 4.0

VMware Server 2.x

VMware vCenter 4.0

VMware VirtualCenter 2.0.2

VMware VirtualCenter 2.5

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2008-1232	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1232
National Vulnerability Database (NVD)
2	CVE-2008-1232	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-1232

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
Apache Tomcat
1	Fixed in Apache Tomcat 4.1.SVN	http://tomcat.apache.org/security-4.html
2	Fixed in Apache Tomcat 5.5.SVN	http://tomcat.apache.org/security-5.html
3	Fixed in Apache Tomcat 6.0.18	http://tomcat.apache.org/security-6.html
Apple Mailing Lists
4	APPLE-SA-2008-10-09 Security Update 2008-007	http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
Apple Security Updates
5	HT3216	http://support.apple.com/kb/HT3216
Apple セキュリティアップデート
6	HT3216	http://support.apple.com/kb/HT3216?viewlocale=ja_JP
Asianux Technical Support Network
7	tomcat5-5.5.23-0jpp.7.1.1AXS3	https://tsn.miraclelinux.com/tsn_local/index.php?m=errata&a=detail&eid=156
HP Security Bulletin
8	HPSBST02955 SSRT101157	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04047415
9	HPSBUX02401 SSRT090005	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01650939
MIRACLE LINUX アップデート情報
10	1381	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=1381
Red Hat Security Advisory
11	RHSA-2008:0648	https://rhn.redhat.com/errata/RHSA-2008-0648.html
12	RHSA-2008:0862	https://rhn.redhat.com/errata/RHSA-2008-0862.html
13	RHSA-2008:0864	https://rhn.redhat.com/errata/RHSA-2008-0864.html
SECURITY BLOG
14	Multiple vulnerabilities in Oracle Java Web Console	https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_oracle_java1
Sun Alert Notification
15	251986	http://sunsolve.sun.com/search/document.do?assetkey=1-66-251986-1
VMware Security Advisories
16	VMSA-2009-0016	http://www.vmware.com/security/advisories/VMSA-2009-0016.html

その他

No	Name	URL
FrSIRT Advisories
1	FrSIRT/ADV-2008-2305	http://www.frsirt.com/english/advisories/2008/2305
ISS X-Force Database
2	44155	http://xforce.iss.net/xforce/xfdb/44155
Secunia Advisory
3	SA31379	http://secunia.com/advisories/31379
4	SA31381	http://secunia.com/advisories/31381
SecurityFocus
5	30496	http://www.securityfocus.com/bid/30496
SecurityTracker
6	1020622	http://www.securitytracker.com/id?1020622

Change Log

No	Changed Details	Date of change
0	[2008年09月03日] 掲載 [2008年10月27日] 影響を受けるシステム：ミラクル・リナックス（tomcat5-5.5.23-0jpp.7.1.1AXS3）の情報を追加ベンダ情報：ミラクル・リナックス（tomcat5-5.5.23-0jpp.7.1.1AXS3）を追加 [2008年11月04日] 影響を受けるシステム：アップル（HT3216）の情報を追加ベンダ情報：アップル（HT3216）を追加 [2009年02月12日] 影響を受けるシステム：ヒューレット・パッカード (HPSBUX02401) の情報を追加影響を受けるシステム：ミラクル・リナックス (1381) の情報を追加ベンダ情報：ヒューレット・パッカード (HPSBUX02401 SSRT090005) を追加ベンダ情報：ミラクル・リナックス (1381) を追加 [2009年03月27日] 影響を受けるシステム：サン・マイクロシステムズ (251986) の情報を追加ベンダ情報：サン・マイクロシステムズ (251986) を追加 [2010年01月05日] 影響を受けるシステム：VMware (VMSA-2009-0016) の情報を追加ベンダ情報：VMware (VMSA-2009-0016) を追加 [2012年09月24日] ベンダ情報：オラクル (Multiple vulnerabilities in Oracle Java Web Console) を追加 [2015年03月25日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：ヒューレット・パッカード (HPSBST02955 SSRT101157) を追加ベンダ情報：アップル（APPLE-SA-2008-10-09 Security Update 2008-007）を追加 [2015年03月26日] ベンダ情報：レッドハット (RHSA-2008:0862) を追加ベンダ情報：レッドハット (RHSA-2008:0864) を追加	Feb. 17, 2018, 10:37 a.m.