Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2008-1232

MediumPublic exploit

Apache Tomcat Cross-site scripting (XSS) vulnerability

Published May 1, 2022 · Updated Aug 7, 2024 · Also known as GHSA-q74x-qqhr-f8rx

Key Facts

Patch immediately
  • CVE-2008-1232 is a medium-severity vulnerability (CVSS 4.3 v2) affecting Tomcat (Apache), org.apache.tomcat:tomcat (maven), tomcat5-admin-webapps (oracle) and 22 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
  • EPSS estimates a 76% probability of exploitation in the next 30 days.
  • Fixed versions are available, including ant 0:1.6.5-1jpp_1rh, Tomcat 4.1.37, avalon-logkit 0:1.2-2jpp_4rh.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v2

4.3

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS (30-day exploit likelihood)

76%

Higher than 99.5% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2008-1232 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.

Affected Products

36 affected entries in total
ProductAffected versionsFixed in
TomcatApacheSee advisory4.1.37
org.apache.tomcat:tomcatmaven>= 4.1.06.0.17
tomcat5-admin-webappsoracleSee advisory5.5.23-0jpp.7.el5_2.1
tomcat5-common-liboracleSee advisory5.5.23-0jpp.7.el5_2.1
tomcat5oracleSee advisory5.5.23-0jpp.7.el5_2.1
20 more affected products in the full CVE brief

Patched Releases

ant

0:1.6.5-1jpp_1rh

Tomcat

4.1.37

avalon-logkit

0:1.2-2jpp_4rh

axis

0:1.2.1-1jpp_3rh

classpathx-jaf

0:1.0-2jpp_6rh

classpathx-mail

0:1.1.1-2jpp_8rh

geronimo-specs

0:1.0-0.M4.1jpp_10rh

jakarta-commons-modeler

0:2.0-3jpp_2rh

jbossweb

0:2.0.0-5.CP07.0jpp.ep1.1.el4, 0:2.0.0-5.CP07.0jpp.ep1.1.el5

log4j

0:1.2.12-1jpp_1rh

mx4j

1:3.0.1-1jpp_4rh

org.apache.tomcat:tomcat

4.1.38, 5.5.27, 6.0.17

pcsc-lite

0:1.3.3-3.el4

rhpki-ca

0:7.3.0-20.el4

rhpki-java-tools

0:7.3.0-10.el4

rhpki-kra

0:7.3.0-14.el4

rhpki-manage

0:7.3.0-19.el4

rhpki-native-tools

0:7.3.0-6.el4

rhpki-ocsp

0:7.3.0-13.el4

rhpki-tks

0:7.3.0-13.el4

tomcat5

0:5.5.23-0jpp_4rh.16, 0:5.5.23-0jpp.7.el5_2.1, 5.5.23-0jpp.7.el5_2.1

tomcat5-admin-webapps

5.5.23-0jpp.7.el5_2.1

tomcat5-common-lib

5.5.23-0jpp.7.el5_2.1

tomcat5-jasper

5.5.23-0jpp.7.el5_2.1

tomcat5-jasper-javadoc

5.5.23-0jpp.7.el5_2.1

Timeline

  1. Publicly disclosed

    May 1, 2022

  2. Last updated

    Aug 7, 2024

Weakness Type

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2008-1232 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo