GHSA-f632-9449-3j4w

Source

https://github.com/advisories/GHSA-f632-9449-3j4w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-f632-9449-3j4w/GHSA-f632-9449-3j4w.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-f632-9449-3j4w

Aliases

Published

2024-11-18T15:33:20Z

Modified

2026-06-18T20:30:24Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Apache Tomcat - XSS in generated JSPs

Details

Description:

The fix for improvement 69333 caused pooled JSP tags not to be released after use which in turn could cause output of some tags not to escaped as expected. This unescaped output could lead to XSS.

Versions Affected:

Apache Tomcat 11.0.0
Apache Tomcat 10.1.31
Apache Tomcat 9.0.96

Mitigation:

Users of the affected versions should apply one of the following mitigations:

Upgrade to Apache Tomcat 11.0.1 or later
Upgrade to Apache Tomcat 10.1.33 or later Note: 10.1.32 was not released
Upgrade to Apache Tomcat 9.0.97 or later

Database specific

{
    "cwe_ids":  [
        "CWE-326"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-11-18T21:03:24Z",
    "nvd_published_at":  "2024-11-18T13:15:04Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven

org.apache.tomcat:tomcat-jasper

Package

Name: org.apache.tomcat:tomcat-jasper; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat-jasper

Affected ranges

Type: ECOSYSTEM
Events: Introduced

11.0.0

Fixed

11.0.1

Affected versions

11.*

11.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-f632-9449-3j4w/GHSA-f632-9449-3j4w.json"

org.apache.tomcat:tomcat-jasper

Package

Name: org.apache.tomcat:tomcat-jasper; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat-jasper

Affected ranges

Type: ECOSYSTEM
Events: Introduced

10.1.31

Fixed

10.1.32

Affected versions

10.*

10.1.31

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-f632-9449-3j4w/GHSA-f632-9449-3j4w.json"

org.apache.tomcat.embed:tomcat-embed-jasper

Package

Name: org.apache.tomcat.embed:tomcat-embed-jasper; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper

Affected ranges

Type: ECOSYSTEM
Events: Introduced

9.0.96

Fixed

9.0.97

Affected versions

9.*

9.0.96

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-f632-9449-3j4w/GHSA-f632-9449-3j4w.json"

org.apache.tomcat.embed:tomcat-embed-jasper

Package

Name: org.apache.tomcat.embed:tomcat-embed-jasper; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper

Affected ranges

Type: ECOSYSTEM
Events: Introduced

11.0.0

Fixed

11.0.1

Affected versions

11.*

11.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-f632-9449-3j4w/GHSA-f632-9449-3j4w.json"

org.apache.tomcat.embed:tomcat-embed-jasper

Package

Name: org.apache.tomcat.embed:tomcat-embed-jasper; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper

Affected ranges

Type: ECOSYSTEM
Events: Introduced

10.1.31

Fixed

10.1.32

Affected versions

10.*

10.1.31

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-f632-9449-3j4w/GHSA-f632-9449-3j4w.json"

org.apache.tomcat:tomcat-jasper

Package

Name: org.apache.tomcat:tomcat-jasper; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat-jasper

Affected ranges

Type: ECOSYSTEM
Events: Introduced

9.0.96

Fixed

9.0.97

Affected versions

9.*

9.0.96

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-f632-9449-3j4w/GHSA-f632-9449-3j4w.json"

org.apache.tomcat:tomcat

Package

Name: org.apache.tomcat:tomcat; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type: ECOSYSTEM
Events: Introduced

11.0.0

Fixed

11.0.1

Affected versions

11.*

11.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-f632-9449-3j4w/GHSA-f632-9449-3j4w.json"

org.apache.tomcat:tomcat

Package

Name: org.apache.tomcat:tomcat; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type: ECOSYSTEM
Events: Introduced

10.1.31

Fixed

10.1.32

Affected versions

10.*

10.1.31

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-f632-9449-3j4w/GHSA-f632-9449-3j4w.json"

org.apache.tomcat:tomcat

Package

Name: org.apache.tomcat:tomcat; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type: ECOSYSTEM
Events: Introduced

9.0.96

Fixed

9.0.97

Affected versions

9.*

9.0.96

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-f632-9449-3j4w/GHSA-f632-9449-3j4w.json"