Vulnerability	Vulnerable Version
M Cross-site Scripting (XSS) org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies. Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The Form authentication example in the examples web application displayed user provided data without filtering, exposing a potential XSS vulnerability. Note: This is a vulnerability in `webapps/examples/jsp/security/protected/index.jsp` file which is not used in any of the core Tomcat artifacts, and which therefore only affects users who did not remove the examples of web application as documented in the Tomcat security guide. How to fix Cross-site Scripting (XSS)? Upgrade `org.apache.tomcat:tomcat` to version 8.5.82, 9.0.65, 10.0.23, 10.1.0-M17 or higher.	[8.5.50,8.5.82)[9.0.30,9.0.65)[10.0.0-M1,10.0.23)[10.1.0-M1,10.1.0-M17)

Cross-site Scripting (XSS)

org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The Form authentication example in the examples web application displayed user provided data without filtering, exposing a potential XSS vulnerability.

Note: This is a vulnerability in webapps/examples/jsp/security/protected/index.jsp file which is not used in any of the core Tomcat artifacts, and which therefore only affects users who did not remove the examples of web application as documented in the Tomcat security guide.

How to fix Cross-site Scripting (XSS)?

Upgrade org.apache.tomcat:tomcat to version 8.5.82, 9.0.65, 10.0.23, 10.1.0-M17 or higher.

[8.5.50,8.5.82)[9.0.30,9.0.65)[10.0.0-M1,10.0.23)[10.1.0-M1,10.1.0-M17)

Go back to all versions of this package