bugtraq - Re: Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability

lists.openwall.net		lists / announce john-users owl-users popa3d-users / xvendor oss-security / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4
Open Source and information security mailing list archives

Order Openwall GNU/*/Linux 2.0 on a CD with delivery worldwide

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Tue, 04 Sep 2007 20:30:31 -0400
From: Mark Thomas <markt@...che.org>
To: bugtraq@...urityfocus.com
Subject: Re: Apache tomcat calendar example cross site scripting and cross
 site request forgery vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

tusharvartak@...mail.com wrote:
> Apache Tomcat/4.1.31 ships with built in examples. One of the example calendar.jsp suffers from input validation error and could be exploited for cross site scriptingand cross site request forgery.

This is CVE-2006-7196 which is fixed in 4.1.32 & 5.5.16.

Kind regards,

Mark

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFG3finb7IeiTPGAkMRApxAAJ9sMCfco8GUEe9LcqbcA+5GE0AKCQCgsEG+
nH4eUojS1ccH9YKtma/GtQU=
=3NtA
-----END PGP SIGNATURE-----