Home > Vulnerability Database > CVE-2007-3386

Mend.io Vulnerability Database

CVE-2007-3386

Date: August 14, 2007

Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.

Severity Score

3.7

Related Resources (35)

Url: http://secunia.com/advisories/33668

Url: http://www.vupen.com/english/advisories/2007/3386

Url: https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html

Url: http://securitytracker.com/id?1018558

Url: http://www.debian.org/security/2008/dsa-1447

Url: http://www.securityfocus.com/archive/1/476448/100/0/threaded

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2007-3386

Url: http://secunia.com/advisories/26465

Url: http://secunia.com/advisories/27037

Url: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554

Url: http://www.securityfocus.com/bid/25314

Url: http://jvn.jp/jp/JVN%2359851336/index.html

Url: http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html

Url: https://exchange.xforce.ibmcloud.com/vulnerabilities/36001

Url: http://www.vupen.com/english/advisories/2009/0233

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10077

Url: https://access.redhat.com/security/cve/CVE-2007-3386

Url: http://www.vupen.com/english/advisories/2007/2880

Url: http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540

Url: http://www.securityfocus.com/archive/1/500412/100/0/threaded

Url: http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx

Url: http://www.vupen.com/english/advisories/2007/3527

Url: http://secunia.com/advisories/27727

Url: https://nvd.nist.gov/vuln/detail/CVE-2007-3386

Url: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795

Url: http://www.securityfocus.com/archive/1/500396/100/0/threaded

Url: http://tomcat.apache.org/security-6.html

Url: http://osvdb.org/36417

Url: http://secunia.com/advisories/27267

Url: http://www.mandriva.com/security/advisories?name=MDKSA-2007:241

Url: http://secunia.com/advisories/28317

Url: http://secunia.com/advisories/26898

Url: http://www.redhat.com/support/errata/RHSA-2007-0871.html

Url: http://securityreason.com/securityalert/3010

Url: https://www.mend.io/vulnerability-database/CVE-2007-3386

Severity Score

3.7

Weakness Type (CWE)

Cross-Site Scripting (XSS)

CWE-79

CVSS v3.1

Base Score:	3.7
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	LOW
Availability (A):	NONE

CVSS v2

Base Score:	4.3
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2007-3386

Date: August 14, 2007

Severity Score

Related Resources (35)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?