CVE-2011-0013

22

FAUCET Score

CVE-2011-0013 describes multiple cross-site scripting (XSS) vulnerabilities found in the HTML Manager Interface of Apache Tomcat versions 5.5 (before 5.5.32), 6.0 (before 6.0.30), and 7.0 (before 7.0.6). This vulnerability allows remote attackers to inject arbitrary web script or HTML, exemplified through the display-name tag. With a CVSS score of 4.3 (medium severity), it has a network attack vector and medium attack complexity, potentially leading to information integrity compromise (e.g., session hijacking or defacement). There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		7.0.0CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:7.0.0:::::::*
		7.0.1CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:7.0.1:::::::*
		7.0.2CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:7.0.2:::::::*
		7.0.3CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:7.0.3:::::::*
		7.0.4CPE matchmatch criteria	cpe:2.3:a:apache:tomcat:7.0.4:::::::*

CVSS Data

CVSS version used by this source: 2.0

4.3MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Exploitability Score

8.6

Impact Score

2.9

CvssVersion

2.0

Exploit Intelligence

EPSS Score

10.23%

Probability of exploitation in next 30 days

EPSS Percentile

95.2%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.1023 is in the 95th percentile among its peer group of 19,955 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (160)

mavenpatch availablevia ghsa

Product: org.apache.tomcat:tomcatFixed in: 5.5.32

mavenpatch availablevia ghsa

Product: org.apache.tomcat:tomcatFixed in: 6.0.30

mavenpatch availablevia ghsa

Product: org.apache.tomcat:tomcatFixed in: 7.0.6

redhatpatch availablevia nvd_reference

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: ant-0:1.7.1-13.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: antlr-0:2.7.7-7.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: bcel-0:5.2-8.1.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: cglib-0:2.2-5.1.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: dom4j-0:1.6.1-11.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: ecj-1:3.3.1.1-3.2.2.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: glassfish-jaf-0:1.1.0-6.1.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: glassfish-javamail-0:1.4.2-0.4.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: glassfish-jsf-0:1.2_13-2.2.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: hibernate3-1:3.3.2-1.5.GA_CP04.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: hibernate3-annotations-0:3.4.0-3.3.GA_CP04.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: hibernate3-commons-annotations-0:3.1.0-1.8.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: hibernate3-ejb-persistence-3.0-api-1:1.0.2-3.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: hibernate3-entitymanager-0:3.4.0-4.3.GA_CP04.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: httpd22-0:2.2.17-14.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-beanutils-0:1.8.0-4.1.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-chain-0:1.2-2.2.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-codec-0:1.3-9.1.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-collections-0:3.2.1-4.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-daemon-1:1.0.5-1.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-daemon-jsvc-1:1.0.5-1.4.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-dbcp-0:1.2.1-16.4.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-digester-0:1.8.1-8.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-el-0:1.0-19.2.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-fileupload-1:1.1.1-7.4.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-httpclient-1:3.1-1.1.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-io-0:1.4-1.3.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-launcher-0:1.1-4.6.1.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-logging-0:1.1.1-0.4.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-logging-jboss-0:1.1-10.2.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-modeler-0:2.0-4.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-pool-0:1.3-11.2.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-commons-validator-0:1.3.1-7.5.1.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-oro-0:2.0.8-3.3.2.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jakarta-taglibs-standard-0:1.1.1-9.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: javassist-0:3.12.0-1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jboss-common-core-0:2.2.17-1.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jboss-common-logging-jdk-0:2.1.2-1.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jboss-common-logging-spi-0:2.1.2-1.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jboss-javaee-0:5.0.1-2.9.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jcommon-0:1.0.16-1.2.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: jfreechart-0:1.0.13-2.3.2.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: log4j-0:1.2.14-18.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: mod_cluster-0:1.0.10-2.GA_CP01.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: mod_cluster-native-0:1.0.10-2.GA_CP01.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: mod_jk-0:1.2.31-1.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: mx4j-1:3.0.1-9.3.4.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: objectweb-asm-0:3.1-5.3.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: regexp-0:1.5-1.2.1.jdk6.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: struts12-0:1.2.9-3.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: tomcat5-0:5.5.33-14_patch_04.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: tomcat6-0:6.0.32-15_patch_03.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: tomcat-jkstatus-ant-0:1.2.31-2.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: tomcat-native-0:1.1.20-2.0.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: xalan-j2-0:2.7.1-5.3_patch_04.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: xerces-j2-0:2.9.1-3.patch01.1.ep5.el4

redhatpatch availablevia redhat_api

Product: JBEWS 1.0 for RHEL 4Fixed in: xml-commons-1:1.3.04-7.12.ep5.el4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: tomcat5-0:5.5.23-0jpp.22.el5_7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: tomcat6-0:6.0.24-33.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: ant-0:1.7.1-13.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: antlr-0:2.7.7-7.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: cglib-0:2.2-5.1.1.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: dom4j-0:1.6.1-11.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: ecj3-1:3.3.1.1-3.1.1.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: glassfish-jsf-0:1.2_13-3.1.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: hibernate3-1:3.3.2-1.4.GA_CP04.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: hibernate3-annotations-0:3.4.0-3.2.GA_CP04.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: hibernate3-commons-annotations-0:3.1.0-1.8.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: hibernate3-ejb-persistence-3.0-api-1:1.0.2-3.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: hibernate3-entitymanager-0:3.4.0-4.3.GA_CP04.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: httpd-0:2.2.17-11.1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-beanutils-0:1.8.0-4.1.2.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-chain-0:1.2-2.2.1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-codec-0:1.3-9.2.1.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-collections-0:3.2.1-4.1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-daemon-1:1.0.5-1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-daemon-jsvc-1:1.0.5-1.4.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-dbcp-0:1.2.1-16.4.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-digester-0:1.8.1-8.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-fileupload-1:1.1.1-7.4.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-httpclient-1:3.1-1.2.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-io-0:1.4-1.3.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-logging-0:1.1.1-0.4.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-logging-jboss-0:1.1-10.2.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-pool-0:1.3-11.2.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-commons-validator-0:1.3.1-7.5.2.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-oro-0:2.0.8-3.3.2.1.1.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jakarta-taglibs-standard-0:1.1.1-9.1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: javassist-0:3.12.0-1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jboss-common-core-0:2.2.17-1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jboss-common-logging-jdk-0:2.1.2-1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jboss-common-logging-spi-0:2.1.2-1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jboss-javaee-0:5.0.1-2.9.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jcommon-0:1.0.16-1.2.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: jfreechart-0:1.0.13-2.3.2.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: mod_cluster-0:1.0.10-2.1.GA_CP01.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: mod_cluster-native-0:1.0.10-2.1.GA_CP01.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: mod_jk-0:1.2.31-1.1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: objectweb-asm-0:3.1-5.3.1.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: struts12-0:1.2.9-3.1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: tomcat5-0:5.5.33-16_patch_04.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: tomcat6-0:6.0.32-15.1_patch_03.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: tomcat-jkstatus-ant-0:1.2.31-2.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: tomcat-native-0:1.1.20-2.1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: xalan-j2-0:2.7.1-5.3_patch_04.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: xerces-j2-0:2.9.1-3.patch01.1.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 5Fixed in: xml-commons-0:1.3.04-7.10.jdk6.ep5.el5

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: ant-0:1.7.1-14.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: antlr-0:2.7.7-7.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: cglib-0:2.2-5.4.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: dom4j-0:1.6.1-11.1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: ecj3-1:3.3.1.1-4.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: glassfish-jsf-0:1.2_13-3.1.4.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: hibernate3-1:3.3.2-1.8.GA_CP04.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: hibernate3-annotations-0:3.4.0-3.5.GA_CP04.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: hibernate3-commons-annotations-0:3.1.0-1.8.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: hibernate3-ejb-persistence-3.0-api-1:1.0.2-3.3.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: hibernate3-entitymanager-0:3.4.0-4.4.GA_CP04.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: httpd-0:2.2.17-11.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-beanutils-0:1.8.0-9.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-chain-0:1.2-2.2.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-codec-0:1.3-12.1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-collections-0:3.2.1-4.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-daemon-1:1.0.5-1.1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-daemon-jsvc-1:1.0.5-1.4.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-dbcp-0:1.2.1-16.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-digester-0:1.8.1-8.1.1.1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-fileupload-1:1.1.1-7.5.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-httpclient-1:3.1-1.2.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-io-0:1.4-4.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-logging-0:1.1.1-1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-logging-jboss-0:1.1-10.2.2.1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-pool-0:1.3-15.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-commons-validator-0:1.3.1-7.5.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-oro-0:2.0.8-7.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jakarta-taglibs-standard-0:1.1.1-12.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: javassist-0:3.12.0-3.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jboss-common-core-0:2.2.17-1.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jboss-common-logging-jdk-0:2.1.2-1.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jboss-common-logging-spi-0:2.1.2-1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jboss-javaee-0:5.0.1-2.9.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jcommon-0:1.0.16-1.2.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: jfreechart-0:1.0.13-2.3.2.1.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: mod_cluster-0:1.0.10-2.2.GA_CP01.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: mod_cluster-native-0:1.0.10-2.1.1.GA_CP01.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: mod_jk-0:1.2.31-1.1.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: objectweb-asm31-0:3.1-12.1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: struts12-0:1.2.9-3.1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: tomcat5-0:5.5.33-15_patch_04.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: tomcat6-0:6.0.32-14_patch_03.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: tomcat-jkstatus-ant-0:1.2.31-2.1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: tomcat-native-0:1.1.20-2.1.2.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: xalan-j2-0:2.7.1-5.3_patch_04.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: xerces-j2-0:2.9.1-8.patch01.1.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 1 for RHEL 6Fixed in: xml-commons-0:1.3.04-7.14.ep5.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 1.0

Vendor Advisories (2)

mavenGHSA-3p86-xgrq-m6p6medium

Improper Neutralization of Input During Web Page Generation in Apache Tomcat

redhatCVE-2011-0013Moderate

tomcat: XSS vulnerability in HTML Manager interface

References

lists.apple.com / archives/Security-announce/2011//Oct/msg00003.html

lists.opensuse.org / opensuse-security-announce/2011-04/msg00000.html

bugzilla.redhat.com / show_bug.cgi

Patch

secunia.com / advisories/43192

Vendor Advisory

secunia.com / advisories/45022

secunia.com / advisories/57126

securityreason.com / securityalert/8093

lists.apache.org / thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E

oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12878

oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14945

oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19269

support.apple.com / kb/HT5002

support.novell.com / docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html

tomcat.apache.org / security-5.html

PatchVendor Advisory

tomcat.apache.org / security-6.html

PatchVendor Advisory

tomcat.apache.org / security-7.html

debian.org / security/2011/dsa-2160

mandriva.com / security/advisories

redhat.com / support/errata/RHSA-2011-0791.html

redhat.com / support/errata/RHSA-2011-0896.html

redhat.com / support/errata/RHSA-2011-0897.html

redhat.com / support/errata/RHSA-2011-1845.html

securityfocus.com / archive/1/516209/30/90/threaded

securityfocus.com / bid/46174

securitytracker.com / id

Exploit

vupen.com / english/advisories/2011/0376

Vendor Advisory