CVE-2018-8031

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
6.1MEDIUM
EPSS
2.3%
top 15.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache TomeeApache Tomee
Timeline
PublishedJul 23
Latest updateMay 14

Description

The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically used to add TomEE features to a Tomcat installation. The TomEE bundles do not ship with this application included. This issue can be mitigated by removing the application after TomEE is setup (if using the application to install TomEE), using one of the provided pre-configured bundles, or by upgrading to TomEE 7.0.5. T…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶NVDapache/tomee< 7.0.5

🔴Vulnerability Details

3
OSV
Apache TomEE console vulnerable to Cross-site Scripting↗2022-05-14
▶
GHSA
Apache TomEE console vulnerable to Cross-site Scripting↗2022-05-14
▶
CVEList
CVE-2018-8031: The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL↗2018-07-23
▶