org.apache.tomcat:tomcat@10.0.11 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.apache.tomcat:tomcat package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Cross-site Scripting (XSS)

org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The Form authentication example in the examples web application displayed user provided data without filtering, exposing a potential XSS vulnerability.

Note: This is a vulnerability in webapps/examples/jsp/security/protected/index.jsp file which is not used in any of the core Tomcat artifacts, and which therefore only affects users who did not remove the examples of web application as documented in the Tomcat security guide.

How to fix Cross-site Scripting (XSS)?

Upgrade org.apache.tomcat:tomcat to version 8.5.82, 9.0.65, 10.0.23, 10.1.0-M17 or higher.

[8.5.50,8.5.82) [9.0.30,9.0.65) [10.0.0-M1,10.0.23) [10.1.0-M1,10.1.0-M17)