Apache Tomcat DOS Device Name XSS

The remote Apache Tomcat web server is vulnerable to a cross site scripting issue. Description : Apache Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. By making requests for DOS Device names it is possible to cause Tomcat to throw an exception, allowing XSS attacks, e.g: tomcat-server/COM2.IMG%20src='Javascript:alert(document.domain)' (angle brackets omitted) The exception also reveals the physical path of the Tomcat installation.
Upgrade to Apache Tomcat v4.1.3 beta or later.