Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0…
Priority MEDIUM 59CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
Why it matters now
EPSS 0.75865 99th percentileScored 2026-11-07
Fix Fixed org.apache.tomcat:tomcat (Maven): 4.1.38, 5.5.27, 6.0.17Red Hat: 6 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 4.1.0 to before 4.1.38 | 4.1.38 | Patch available | GHSA-q74x-qqhr-f8rx |
| — | org.apache.tomcat:tomcat (Maven) | 5.5.0 to before 5.5.27 | 5.5.27 | Patch available | GHSA-q74x-qqhr-f8rx |
| — | org.apache.tomcat:tomcat (Maven) | 6.0.0 to before 6.0.17 | 6.0.17 | Patch available | GHSA-q74x-qqhr-f8rx |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 4.1.0 to before 4.1.38 Fixed in 4.1.38 Patch available GHSA-q74x-qqhr-f8rx
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 5.5.0 to before 5.5.27 Fixed in 5.5.27 Patch available GHSA-q74x-qqhr-f8rx
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 6.0.0 to before 6.0.17 Fixed in 6.0.17 Patch available GHSA-q74x-qqhr-f8rx
Remediation
- Fix · GHSA-q74x-qqhr-f8rx org.apache.tomcat:tomcat (Maven) Fixed in 4.1.38 Advisory →
- Fix · GHSA-q74x-qqhr-f8rx org.apache.tomcat:tomcat (Maven) Fixed in 5.5.27 Advisory →
- Fix · GHSA-q74x-qqhr-f8rx org.apache.tomcat:tomcat (Maven) Fixed in 6.0.17 Advisory →
Red Hat 6 advisories
- RHSA-2010:0602 Released 2010-08-04 · Red Hat rating ModerateRed Hat Certificate System 7.3 security update
- Red Hat Certificate System 7.3 for 4AS ant-1.6.5-1jpp_1rh, avalon-logkit-1.2-2jpp_4rh, axis-1.2.1-1jpp_3rh +39
- Red Hat Certificate System 7.3 for 4ES ant-1.6.5-1jpp_1rh, avalon-logkit-1.2-2jpp_4rh, axis-1.2.1-1jpp_3rh +39
- RHSA-2008:1007 Released 2008-12-08 · Red Hat rating Lowtomcat security update for Red Hat Network Satellite Server
- Red Hat Satellite 5.0 (RHEL v.4 AS) tomcat5-5.0.30-0jpp_12rh
- Red Hat Satellite 5.1 (RHEL v.4 AS) tomcat5-5.0.30-0jpp_12rh
- RHSA-2008:0862 Released 2008-10-02 · Red Hat rating Importanttomcat security update
- Red Hat Application Server v2 4AS tomcat5-5.5.23-0jpp_4rh.9, tomcat5-admin-webapps-5.5.23-0jpp_4rh.9, tomcat5-common-lib-5.5.23-0jpp_4rh.9 +8
- Red Hat Application Server v2 4ES tomcat5-5.5.23-0jpp_4rh.9, tomcat5-admin-webapps-5.5.23-0jpp_4rh.9, tomcat5-common-lib-5.5.23-0jpp_4rh.9 +8
- Red Hat Application Server v2 4WS tomcat5-5.5.23-0jpp_4rh.9, tomcat5-admin-webapps-5.5.23-0jpp_4rh.9, tomcat5-common-lib-5.5.23-0jpp_4rh.9 +8
Show 3 more Red Hat advisories
- RHSA-2008:0864 Released 2008-10-02 · Red Hat rating Importanttomcat security update
- Red Hat Developer Suite v.3 (AS v.4) tomcat5-5.5.23-0jpp_12rh, tomcat5-common-lib-5.5.23-0jpp_12rh, tomcat5-jasper-5.5.23-0jpp_12rh +3
- RHSA-2008:0877 Released 2008-09-22 · Red Hat rating Importantjbossweb security update
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS jbossweb-2.0.0-5.CP07.0jpp.ep1.1.el4
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES jbossweb-2.0.0-5.CP07.0jpp.ep1.1.el4
- Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server jbossweb-2.0.0-5.CP07.0jpp.ep1.1.el5
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS jbossweb-2.0.0-5.CP07.0jpp.ep1.1.el4
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES jbossweb-2.0.0-5.CP07.0jpp.ep1.1.el4
- Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server jbossweb-2.0.0-5.CP07.0jpp.ep1.1.el5
- RHSA-2008:0648 Released 2008-08-27 · Red Hat rating Importanttomcat security update
- Red Hat Enterprise Linux (v. 5 server) tomcat5-5.5.23-0jpp.7.el5_2.1, tomcat5-5.5.23-0jpp.7.el5_2.1.i386, tomcat5-5.5.23-0jpp.7.el5_2.1.ia64 +41
- Red Hat Enterprise Linux Desktop (v. 5 client) tomcat5-5.5.23-0jpp.7.el5_2.1, tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_2.1, tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_2.1.i386 +2
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) tomcat5-5.5.23-0jpp.7.el5_2.1, tomcat5-5.5.23-0jpp.7.el5_2.1.i386, tomcat5-admin-webapps-5.5.23-0jpp.7.el5_2.1 +15
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Application Server v2 4AS | Fixed | RHSA-2008:0862 |
| Red Hat Application Server v2 4ES | Fixed | RHSA-2008:0862 |
| Red Hat Application Server v2 4WS | Fixed | RHSA-2008:0862 |
| Red Hat Certificate System 7.3 for 4AS | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 for 4ES | Fixed | RHSA-2010:0602 |
| Red Hat Developer Suite v.3 (AS v.4) | Fixed | RHSA-2008:0864 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2008:0648 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2008:0648 |
| Red Hat Enterprise Linux Desktop Workstation (v. 5 client) | Fixed | RHSA-2008:0648 |
| Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS | Fixed | RHSA-2008:0877 |
| Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES | Fixed | RHSA-2008:0877 |
| Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server | Fixed | RHSA-2008:0877 |
| Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS | Fixed | RHSA-2008:0877 |
| Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES | Fixed | RHSA-2008:0877 |
| Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server | Fixed | RHSA-2008:0877 |
| Red Hat Satellite 5.0 (RHEL v.4 AS) | Fixed | RHSA-2008:1007 |
| Red Hat Satellite 5.1 (RHEL v.4 AS) | Fixed | RHSA-2008:1007 |
Timeline
- 2026-10-02 Threatist record created from CVE-2008-1232
- 2026-10-03 Alias added: GHSA-q74x-qqhr-f8rx
References
Advisory 21
- http://tomcat.apache.org/security-4.html
- RHSA-2008:0862
- http://www.vmware.com/security/advisories/VMSA-2009-0002.html
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- 4098
- FEDORA-2008-8130
- SUSE-SR:2008:018
- MDVSA-2008:188
- http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm
- RHSA-2008:0864
- SUSE-SR:2009:004
- http://tomcat.apache.org/security-6.html
- FEDORA-2008-7977
- FEDORA-2008-8113
- http://tomcat.apache.org/security-5.html
- HPSBUX02401
- HPSBST02955
- APPLE-SA-2008-10-09
- http://support.apple.com/kb/HT3216
- RHSA-2008:0648
- https://nvd.nist.gov/vuln/detail/CVE-2008-1232
Other 36
- oval:org.mitre.oval:def:5985
- ADV-2009-1609
- ADV-2009-2194
- http://community.ca.com/blogs/casecurityresponseblog/archive/2009/06/15/ca20090615-02-ca-service-desk-tomcat-cross-site-scripting-vulnerability.aspx
- ADV-2008-2823
- oval:org.mitre.oval:def:11181
- https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=214095
- ADV-2009-0320
- https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=209500
- ADV-2008-2305
- ADV-2008-2780
- ADV-2009-0503
- ADV-2009-3316
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/
- https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E
- https://github.com/apache/tomcat
- https://bugzilla.redhat.com/show_bug.cgi?id=457597
- https://access.redhat.com/security/cve/CVE-2008-1232
- https://access.redhat.com/errata/RHSA-2010:0602
- https://access.redhat.com/errata/RHSA-2008:1007
- https://access.redhat.com/errata/RHSA-2008:0877
- https://access.redhat.com/errata/RHSA-2008:0864
- https://access.redhat.com/errata/RHSA-2008:0862
- https://access.redhat.com/errata/RHSA-2008:0648
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2008-1232 · CVE Program
- CVE-2008-1232 · NVD
- FIRST EPSS
- GHSA-q74x-qqhr-f8rx · GitHub Advisory Database · CC BY 4.0
- CVE-2008-1232 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences