Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0…
Priority LOW 32CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
Why it matters now
EPSS 0.09776 95th percentileScored 2026-11-07
Fix Fixed org.apache.tomcat:tomcat (Maven): 5.5.27, 6.0.18org.apache.tomcat.embed:tomcat-embed-core (Maven): 5.5.27, 6.0.18Red Hat: 4 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 5.5.9 to before 5.5.27 | 5.5.27 | Patch available | GHSA-f98p-9pp6-7q6c |
| — | org.apache.tomcat:tomcat (Maven) | 6.0.0 to before 6.0.18 | 6.0.18 | Patch available | GHSA-f98p-9pp6-7q6c |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 5.5.9 to before 5.5.27 | 5.5.27 | Patch available | GHSA-f98p-9pp6-7q6c |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 6.0.0 to before 6.0.18 | 6.0.18 | Patch available | GHSA-f98p-9pp6-7q6c |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 5.5.9 to before 5.5.27 Fixed in 5.5.27 Patch available GHSA-f98p-9pp6-7q6c
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 6.0.0 to before 6.0.18 Fixed in 6.0.18 Patch available GHSA-f98p-9pp6-7q6c
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 5.5.9 to before 5.5.27 Fixed in 5.5.27 Patch available GHSA-f98p-9pp6-7q6c
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 6.0.0 to before 6.0.18 Fixed in 6.0.18 Patch available GHSA-f98p-9pp6-7q6c
CPE configurations NVD · 35
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:* | 5.5.9 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:* | 5.5.10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:* | 5.5.11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:* | 5.5.12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:* | 5.5.13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:* | 5.5.14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:* | 5.5.15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:* | 5.5.16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:* | 5.5.17 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:* | 5.5.18 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:* Versions 5.5.9 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:* Versions 5.5.10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:* Versions 5.5.11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.12:*:*:*:*:*:*:* Versions 5.5.12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.13:*:*:*:*:*:*:* Versions 5.5.13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.14:*:*:*:*:*:*:* Versions 5.5.14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.15:*:*:*:*:*:*:* Versions 5.5.15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.16:*:*:*:*:*:*:* Versions 5.5.16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.17:*:*:*:*:*:*:* Versions 5.5.17 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.18:*:*:*:*:*:*:* Versions 5.5.18 Vulnerable ·Apache
Show 25 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:* | 5.5.19 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:* | 5.5.20 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:* | 5.5.21 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:* | 5.5.22 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:* | 5.5.23 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:* | 5.5.24 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:* | 5.5.25 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:* | 5.5.26 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* | 6.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* | 6.0.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* | 6.0.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* | 6.0.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* | 6.0.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* | 6.0.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* | 6.0.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* | 6.0.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* | 6.0.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* | 6.0.9 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* | 6.0.10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* | 6.0.11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* | 6.0.12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* | 6.0.13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* | 6.0.14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:* | 6.0.15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:* | 6.0.16 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:5.5.19:*:*:*:*:*:*:* Versions 5.5.19 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.20:*:*:*:*:*:*:* Versions 5.5.20 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.21:*:*:*:*:*:*:* Versions 5.5.21 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.22:*:*:*:*:*:*:* Versions 5.5.22 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.23:*:*:*:*:*:*:* Versions 5.5.23 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.24:*:*:*:*:*:*:* Versions 5.5.24 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.25:*:*:*:*:*:*:* Versions 5.5.25 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:5.5.26:*:*:*:*:*:*:* Versions 5.5.26 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* Versions 6.0.1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* Versions 6.0.2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* Versions 6.0.3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* Versions 6.0.4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* Versions 6.0.5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* Versions 6.0.6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* Versions 6.0.7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* Versions 6.0.8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* Versions 6.0.9 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* Versions 6.0.10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* Versions 6.0.11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* Versions 6.0.12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* Versions 6.0.13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* Versions 6.0.14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:* Versions 6.0.15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:* Versions 6.0.16 Vulnerable ·Apache
Remediation
- Fix · GHSA-f98p-9pp6-7q6c org.apache.tomcat:tomcat (Maven) Fixed in 5.5.27 Advisory →
- Fix · GHSA-f98p-9pp6-7q6c org.apache.tomcat:tomcat (Maven) Fixed in 6.0.18 Advisory →
- Fix · GHSA-f98p-9pp6-7q6c org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 5.5.27 Advisory →
- Fix · GHSA-f98p-9pp6-7q6c org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 6.0.18 Advisory →
Red Hat 4 advisories
- RHSA-2008:1007 Released 2008-12-08 · Red Hat rating Lowtomcat security update for Red Hat Network Satellite Server
- Red Hat Satellite 5.0 (RHEL v.4 AS) tomcat5-5.0.30-0jpp_12rh
- Red Hat Satellite 5.1 (RHEL v.4 AS) tomcat5-5.0.30-0jpp_12rh
- RHSA-2008:0862 Released 2008-10-02 · Red Hat rating Importanttomcat security update
- Red Hat Application Server v2 4AS tomcat5-5.5.23-0jpp_4rh.9, tomcat5-admin-webapps-5.5.23-0jpp_4rh.9, tomcat5-common-lib-5.5.23-0jpp_4rh.9 +8
- Red Hat Application Server v2 4ES tomcat5-5.5.23-0jpp_4rh.9, tomcat5-admin-webapps-5.5.23-0jpp_4rh.9, tomcat5-common-lib-5.5.23-0jpp_4rh.9 +8
- Red Hat Application Server v2 4WS tomcat5-5.5.23-0jpp_4rh.9, tomcat5-admin-webapps-5.5.23-0jpp_4rh.9, tomcat5-common-lib-5.5.23-0jpp_4rh.9 +8
- RHSA-2008:0864 Released 2008-10-02 · Red Hat rating Importanttomcat security update
- Red Hat Developer Suite v.3 (AS v.4) tomcat5-5.5.23-0jpp_12rh, tomcat5-common-lib-5.5.23-0jpp_12rh, tomcat5-jasper-5.5.23-0jpp_12rh +3
Show 1 more Red Hat advisories
- RHSA-2008:0648 Released 2008-08-27 · Red Hat rating Importanttomcat security update
- Red Hat Enterprise Linux (v. 5 server) tomcat5-5.5.23-0jpp.7.el5_2.1, tomcat5-5.5.23-0jpp.7.el5_2.1.i386, tomcat5-5.5.23-0jpp.7.el5_2.1.ia64 +41
- Red Hat Enterprise Linux Desktop (v. 5 client) tomcat5-5.5.23-0jpp.7.el5_2.1, tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_2.1, tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_2.1.i386 +2
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) tomcat5-5.5.23-0jpp.7.el5_2.1, tomcat5-5.5.23-0jpp.7.el5_2.1.i386, tomcat5-admin-webapps-5.5.23-0jpp.7.el5_2.1 +15
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Application Server v2 4AS | Fixed | RHSA-2008:0862 |
| Red Hat Application Server v2 4ES | Fixed | RHSA-2008:0862 |
| Red Hat Application Server v2 4WS | Fixed | RHSA-2008:0862 |
| Red Hat Developer Suite v.3 (AS v.4) | Fixed | RHSA-2008:0864 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2008:0648 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2008:0648 |
| Red Hat Enterprise Linux Desktop Workstation (v. 5 client) | Fixed | RHSA-2008:0648 |
| Red Hat Satellite 5.0 (RHEL v.4 AS) | Fixed | RHSA-2008:1007 |
| Red Hat Satellite 5.1 (RHEL v.4 AS) | Fixed | RHSA-2008:1007 |
Timeline
- 2026-10-02 Threatist record created from CVE-2008-1947
- 2026-10-03 Alias added: GHSA-f98p-9pp6-7q6c
References
Advisory 14
Other 37
- [tomcat-user] 20080602 [SECURITY] CVE-2008-1947: Tomcat host-manager XSS vulnerability
- oval:org.mitre.oval:def:6009
- ADV-2008-2823
- http://www.vmware.com/security/advisories/VMSA-2009-0002.html
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- ADV-2008-1725
- oval:org.mitre.oval:def:11534
- http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm
- ADV-2009-0320
- http://tomcat.apache.org/security-6.html
- http://tomcat.apache.org/security-5.html
- ADV-2008-2780
- http://support.apple.com/kb/HT3216
- ADV-2009-0503
- ADV-2009-3316
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/
- https://github.com/apache/tomcat/commit/ab6a6c41ac972c845717c9d639f0335865afab4d
- https://github.com/apache/tomcat/commit/78ad0fcbe29c824f1f2e45a4e2716247b033250a
- https://github.com/apache/tomcat/commit/49c71fc59c1b8f8da77aea9eb53e61db168aebab
- https://github.com/apache/tomcat/commit/5f00d434c8dc11bd49ce0b4b56fe889839056030
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E
- https://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
- https://web.archive.org/web/20200514224656/http://www.securityfocus.com/archive/1/507985/100/0/threaded
- https://web.archive.org/web/20201208011750/http://www.securityfocus.com/archive/1/492958/100/0/threaded
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E
- https://github.com/apache/tomcat
- https://bugzilla.redhat.com/show_bug.cgi?id=446393
- https://access.redhat.com/security/cve/CVE-2008-1947
- https://access.redhat.com/errata/RHSA-2008:1007
- https://access.redhat.com/errata/RHSA-2008:0864
- https://access.redhat.com/errata/RHSA-2008:0862
- https://access.redhat.com/errata/RHSA-2008:0648
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2008-1947 · CVE Program
- CVE-2008-1947 · NVD
- FIRST EPSS
- GHSA-f98p-9pp6-7q6c · GitHub Advisory Database · CC BY 4.0
- CVE-2008-1947 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences