tomcat: cross-site scripting
| Package(s): | tomcat6 |
CVE #(s): | CVE-2010-4172
|
| Created: | January 24, 2011 |
Updated: | May 19, 2011 |
| Description: |
From the Ubuntu advisory:
It was discovered that Tomcat did not properly escape certain parameters in
the Manager application which could result in browsers becoming vulnerable
to cross-site scripting attacks when processing the output. With cross-site
scripting vulnerabilities, if a user were tricked into viewing server
output during a crafted server request, a remote attacker could exploit
this to modify the contents, or steal confidential data (such as
passwords), within the same domain.
|
| Alerts: |
|
