CVE-2007-1358: apache tomcat

Modified

AliasesGHSA-xmc9-6p56-3c4v

Published 09-05-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-1358 is a low (CVSS 2.6) vulnerability in apache tomcat. EPSS estimates a 19.89% chance of exploitation in the next 30 days, higher than 97.4% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 2.6, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

2.6/10

010

Low · v2.0 (NVD)

EPSS score

19.89%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 9

RHSA-2007:0326 RHSA-2007:0327 RHSA-2007:0328 RHSA-2007:0360 RHSA-2007:0876 RHSA-2008:0261+3 more

Timeline

09-05-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CVSS metrics

1 score · 1 source · 1 version

v2.02.6

EPSS trend

Probability

19.89%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 19.89% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Apache1 product

tomcat≤ 4.1.31 | 4.0.0 | 4.0.1 | 4.0.2 | 4.0.3 | 4.0.4 | 4.0.5 | 4.0.6 | 4.1.0

Org.apache.tomcat1 product

tomcat≥ 4.0.0, ≤ 4.0.6 | ≥ 4.1.0, ≤ 4.1.34

2 vendors · 2 products

References

42 links

tomcat.apache.org/security-4.htmlX Refsource CONFIRMVendor AdvisoryWEB
secunia.com/advisories/30908Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/25721Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2007/2732VDB EntryX Refsource VUPEN
rhn.redhat.com/errata/RHSA-2008-0630.htmlVendor AdvisoryX Refsource REDHATWEB
sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1Vendor AdvisoryX Refsource SUNALERT
www.vupen.com/english/advisories/2007/3087VDB EntryX Refsource VUPEN
secunia.com/advisories/30899Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.htmlVendor AdvisoryX Refsource FEDORAWEB
secunia.com/advisories/31493Third Party AdvisoryX Refsource SECUNIAVendor Advisory

Show all 42 references

www.vupen.com/english/advisories/2008/1979/referencesVDB EntryX Refsource VUPEN
lists.apple.com/archives/security-announce//2007/Jul/msg00004.htmlVendor AdvisoryX Refsource APPLEWEB
www.securityfocus.com/archive/1/500412/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/33668Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/archive/1/500396/100/0/threadedMailing ListX Refsource BUGTRAQ
www.vupen.com/english/advisories/2007/1729VDB EntryX Refsource VUPEN
osvdb.org/34881VDB EntryX Refsource OSVDB
www.securityfocus.com/bid/24524VDB EntryX Refsource BID
www.vupen.com/english/advisories/2009/0233VDB EntryX Refsource VUPEN
www.fujitsu.com/global/support/software/security/products-f/interstage-200704e.htmlX Refsource CONFIRM
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10679VDB EntrySignatureX Refsource OVAL
www.vupen.com/english/advisories/2007/3386VDB EntryX Refsource VUPEN
www.securityfocus.com/archive/1/471719/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/27037Third Party AdvisoryX Refsource SECUNIAVendor Advisory
docs.info.apple.com/article.html?artnum=306172X Refsource CONFIRMWEB
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795Vendor AdvisoryX Refsource HP
secunia.com/advisories/27727Third Party AdvisoryX Refsource SECUNIAVendor Advisory
jvn.jp/jp/JVN%2316535199/index.htmlThird Party AdvisoryX Refsource JVN
www.securityfocus.com/bid/25159VDB EntryX Refsource BID
secunia.com/advisories/26660Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/support/errata/RHSA-2008-0261.htmlVendor AdvisoryX Refsource REDHATWEB
www.securitytracker.com/id?1018269VDB EntryX Refsource SECTRACK
community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspxX Refsource CONFIRM
support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540X Refsource CONFIRM
secunia.com/advisories/26235Third Party AdvisoryX Refsource SECUNIAVendor Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
nvd.nist.gov/vuln/detail/CVE-2007-1358Advisory
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB