Vulnerability Details : CVE-2007-3383
Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2007-3383
- cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.31:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.36:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.28:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.15:*:*:*:*:*:*:*
Threat overview for CVE-2007-3383
Top countries where our scanners detected CVE-2007-3383
Top open port discovered on systems with this issue
80
IPs affected by CVE-2007-3383 604
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2007-3383!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2007-3383
20.42%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 96 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2007-3383
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
References for CVE-2007-3383
-
https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E
svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/-Apache Mail Archives
-
http://tomcat.apache.org/security-4.html
Apache Tomcat® - Apache Tomcat 4.x vulnerabilitiesPatch
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/35536
Apache Tomcat SendMailServlet example cross-site scripting CVE-2007-3383 Vulnerability Report
-
http://www.kb.cert.org/vuls/id/862600
VU#862600 - Apache Tomcat SendMailServlet example vulnerable to cross-site scripting via FROM fieldPatch;US Government Resource
-
https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E
Apache Mail Archives
-
http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
-
http://www.vupen.com/english/advisories/2008/1981/references
Webmail: access your OVH emails on ovhcloud.com | OVHcloud
-
http://support.apple.com/kb/HT2163
About the security content of Security Update 2008-004 and Mac OS X 10.5.4 - Apple Support
-
https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E
svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/-Apache Mail Archives
-
http://www.securityfocus.com/bid/24999
-
http://securityreason.com/securityalert/2918
-
http://www.securityfocus.com/archive/1/474413/100/0/threaded
-
http://seclists.org/fulldisclosure/2007/Jul/0448.html
Full Disclosure: CVE-2007-3383: XSS in Tomcat send mail examplePatch
-
http://www.vupen.com/english/advisories/2007/2618
Jump to