CVE-2007-1358

17

FAUCET Score

CVE-2007-1358 is a Cross-site Scripting (XSS) vulnerability affecting Apache Tomcat versions 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34. This flaw allows remote attackers to inject arbitrary web script or HTML by manipulating non-RFC 2616 compliant "Accept-Language" headers. With a CVSS score of 2.6, it is a low-severity vulnerability, requiring high attack complexity and resulting in only partial integrity impact (P). There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		<= 4.1.31CPE matchmatch criteria	cpe:2.3:a:apache:tomcat::::::::
		4.0.0CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:4.0.0:::::::*
		4.0.1CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:4.0.1:::::::*
		4.0.2CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:4.0.2:::::::*
		4.0.3CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:4.0.3:::::::*

CVSS Data

CVSS version used by this source: 2.0

2.6LOW

AV:N/AC:H/Au:N/C:N/I:P/A:N

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Exploitability Score

4.9

Impact Score

2.9

CvssVersion

2.0

Exploit Intelligence

EPSS Score

19.89%

Probability of exploitation in next 30 days

EPSS Percentile

97.2%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.1989 is in the 98th percentile among its peer group of 1,506 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.3 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (63)

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: ant-0:1.6.5-1jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: avalon-logkit-0:1.2-2jpp_4rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: axis-0:1.2.1-1jpp_3rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: classpathx-jaf-0:1.0-2jpp_6rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: classpathx-mail-0:1.1.1-2jpp_8rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: geronimo-specs-0:1.0-0.M4.1jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: jakarta-commons-modeler-0:2.0-3jpp_2rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: log4j-0:1.2.12-1jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: mx4j-1:3.0.1-1jpp_4rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: pcsc-lite-0:1.3.3-3.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-ca-0:7.3.0-20.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-java-tools-0:7.3.0-10.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-kra-0:7.3.0-14.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-manage-0:7.3.0-19.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-native-tools-0:7.3.0-6.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-ocsp-0:7.3.0-13.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: rhpki-tks-0:7.3.0-13.el4

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: tomcat5-0:5.5.23-0jpp_4rh.16

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: xerces-j2-0:2.7.1-1jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Certificate System 7.3Fixed in: xml-commons-0:1.3.02-2jpp_1rh

redhatpatch availablevia redhat_api

Product: Red Hat Developer Suite V.3Fixed in: jakarta-commons-modeler-0:2.0-3jpp_3rh

redhatpatch availablevia redhat_api

Product: Red Hat Developer Suite V.3Fixed in: tomcat5-0:5.5.23-0jpp_6rh

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: jakarta-commons-modeler-0:1.1-8jpp.1.0.2.el5

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: tomcat5-0:5.5.23-0jpp.1.0.3.el5

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: jabberd-0:2.0s10-3.38.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: jfreechart-0:0.9.20-3.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: openmotif21-0:2.1.30-11.RHEL4.6

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: perl-Crypt-CBC-0:2.24-1.el4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: rhn-modjk-0:1.2.23-2rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: rhn-modperl-0:1.29-16.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: rhn-modssl-0:2.8.12-8.rhn.10.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2Fixed in: tomcat5-0:5.0.30-0jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: jabberd-0:2.0s10-3.37.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: jfreechart-0:0.9.20-3.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: openmotif21-0:2.1.30-9.RHEL3.8

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: perl-Crypt-CBC-0:2.24-1.el3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: rhn-modjk-0:1.2.23-2rhn.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: rhn-modperl-0:1.29-16.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: rhn-modssl-0:2.8.12-8.rhn.10.rhel3

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 4.2 (RHEL3)Fixed in: tomcat5-0:5.0.30-0jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: jabberd-0:2.0s10-3.38.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: jfreechart-0:0.9.20-3.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: openmotif21-0:2.1.30-11.RHEL4.6

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: perl-Crypt-CBC-0:2.24-1.el4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: rhn-apache-0:1.3.27-36.rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: rhn-modjk-0:1.2.23-2rhn.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: rhn-modperl-0:1.29-16.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: rhn-modssl-0:2.8.12-8.rhn.10.rhel4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.0Fixed in: tomcat5-0:5.0.30-0jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.1Fixed in: jfreechart-0:0.9.20-3.rhn

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.1Fixed in: mod_perl-0:2.0.2-12.el4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.1Fixed in: perl-Crypt-CBC-0:2.24-1.el4

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.1Fixed in: rhn-web-0:5.1.1-7

redhatpatch availablevia redhat_api

Product: Red Hat Network Satellite Server v 5.1Fixed in: tomcat5-0:5.0.30-0jpp_10rh

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: jbossas-0:4.0.5-2.CP04.el4s1.2

redhatpatch availablevia redhat_api

Product: RHAPS Version 2 for RHEL 4Fixed in: jakarta-commons-modeler-0:2.0-3jpp_2rh

redhatpatch availablevia redhat_api

Product: RHAPS Version 2 for RHEL 4Fixed in: tomcat5-0:5.5.23-0jpp_4rh.3

redhatpatch availablevia redhat_api

Product: RHAPS Version 2 for RHEL 4Fixed in: tomcat5-0:5.5.23-0jpp_4rh.4

Vendor Advisories (2)

mavenGHSA-xmc9-6p56-3c4vlow

Apache Tomcat XSS In Accept-Language Headers

redhatCVE-2007-1358Low

tomcat accept-language xss flaw

References

community.ca.com / blogs/casecurityresponseblog/archive/2009/01/23.aspx

docs.info.apple.com / article.html

h20000.www2.hp.com / bizsupport/TechSupport/Document.jsp

jvn.jp / jp/JVN%2316535199/index.html

lists.apple.com / archives/security-announce//2007/Jul/msg00004.html

osvdb.org / 34881

rhn.redhat.com / errata/RHSA-2008-0630.html

secunia.com / advisories/25721

Vendor Advisory

secunia.com / advisories/26235

Vendor Advisory

secunia.com / advisories/26660

Vendor Advisory

secunia.com / advisories/27037

Vendor Advisory

secunia.com / advisories/27727

Vendor Advisory

secunia.com / advisories/30899

Vendor Advisory

secunia.com / advisories/30908

Vendor Advisory

secunia.com / advisories/31493

Vendor Advisory

secunia.com / advisories/33668

Vendor Advisory

lists.apache.org / thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E

oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10679

sunsolve.sun.com / search/document.do

support.ca.com / irj/portal/anonymous/phpsupcontent

redhat.com / archives/fedora-package-announce/2007-November/msg00525.html

tomcat.apache.org / security-4.html

Vendor Advisory

fujitsu.com / global/support/software/security/products-f/interstage-200704e.html

redhat.com / support/errata/RHSA-2008-0261.html

securityfocus.com / archive/1/471719/100/0/threaded

securityfocus.com / archive/1/500396/100/0/threaded

securityfocus.com / archive/1/500412/100/0/threaded

securityfocus.com / bid/24524

securityfocus.com / bid/25159

securitytracker.com / id

vupen.com / english/advisories/2007/1729

vupen.com / english/advisories/2007/2732

vupen.com / english/advisories/2007/3087

vupen.com / english/advisories/2007/3386

vupen.com / english/advisories/2008/1979/references

vupen.com / english/advisories/2009/0233