CVE-2010-4172

35Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 42%

from disclosure to weapon0 days

Published on NVDNov 26

1st PoCNov 22

exploitation probability

42%top 1% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/35011

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0285.html http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://marc.info/?l=bugtraq&m=139344343412337&w=2 https://bugzilla.redhat.com/show_bug.cgi?id=656246 http://secunia.com/advisories/42337 http://secunia.com/advisories/43019 http://secunia.com/advisories/45022 http://secunia.com/advisories/57126 http://securitytracker.com/id?1024764 https://exchange.xforce.ibmcloud.com/vulnerabilities/63422 http://support.apple.com/kb/HT5002 http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html