Description
Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp. NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.
Remediation
References
Related Vulnerabilities
silverstripeCMS Other Vulnerability (CVE-2015-5062)
Jenkins CVE-2014-2063 Vulnerability (CVE-2014-2063)
Rukovoditel Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2018-20166)
WordPress Plugin Downloads Manager 'upload.php' Arbitrary File Upload (0.2)
Drupal Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-5020)