CVE-2007-3383
published 2007-07-25CVE-2007-3383: Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through…
PriorityP419medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
9.48%
94.9th percentile
Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache Tomcat SendMailServlet XSS
osv·2022-05-01
CVE-2007-3383 [MEDIUM] Apache Tomcat SendMailServlet XSS
Apache Tomcat SendMailServlet XSS
Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (`examples/jsp/mail/sendmail.jsp`) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.
GHSA
Apache Tomcat SendMailServlet XSS
ghsa·2022-05-01
CVE-2007-3383 [MEDIUM] CWE-80 Apache Tomcat SendMailServlet XSS
Apache Tomcat SendMailServlet XSS
Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (`examples/jsp/mail/sendmail.jsp`) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.htmlhttp://osvdb.org/39000http://seclists.org/fulldisclosure/2007/Jul/0448.htmlhttp://secunia.com/advisories/30802http://securityreason.com/securityalert/2918http://support.apple.com/kb/HT2163http://tomcat.apache.org/security-4.htmlhttp://www.kb.cert.org/vuls/id/862600http://www.securityfocus.com/archive/1/474413/100/0/threadedhttp://www.securityfocus.com/bid/24999http://www.vupen.com/english/advisories/2007/2618http://www.vupen.com/english/advisories/2008/1981/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/35536https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3Ehttp://lists.apple.com/archives/security-announce/2008//Jun/msg00002.htmlhttp://osvdb.org/39000http://seclists.org/fulldisclosure/2007/Jul/0448.htmlhttp://secunia.com/advisories/30802http://securityreason.com/securityalert/2918http://support.apple.com/kb/HT2163http://tomcat.apache.org/security-4.htmlhttp://www.kb.cert.org/vuls/id/862600http://www.securityfocus.com/archive/1/474413/100/0/threadedhttp://www.securityfocus.com/bid/24999http://www.vupen.com/english/advisories/2007/2618http://www.vupen.com/english/advisories/2008/1981/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/35536https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
2007-07-25
Published