tomcat examples XSS
Published Jan 18, 2006
4.3
MEDIUMCVSS 2.0
EPSS 32.25%
Description
Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.
Affected products
No data.
No data.
Red Hat Application Server 3AS
n/a
Fixed · RHSA-2006:0592
Red Hat Application Server v2 4AS
n/a
Fixed · RHSA-2006:0161
Red Hat Network Satellite Server v 4.2
jabberd-0:2.0s10-3.38.rhn
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2
java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2
jfreechart-0:0.9.20-3.rhn
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2
openmotif21-0:2.1.30-11.RHEL4.6
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2
perl-Crypt-CBC-0:2.24-1.el4
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2
rhn-apache-0:1.3.27-36.rhn.rhel4
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2
rhn-modjk-0:1.2.23-2rhn.rhel4
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2
rhn-modperl-0:1.29-16.rhel4
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2
rhn-modssl-0:2.8.12-8.rhn.10.rhel4
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2
tomcat5-0:5.0.30-0jpp_10rh
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2 (RHEL3)
jabberd-0:2.0s10-3.37.rhn
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2 (RHEL3)
java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2 (RHEL3)
jfreechart-0:0.9.20-3.rhn
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2 (RHEL3)
openmotif21-0:2.1.30-9.RHEL3.8
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2 (RHEL3)
perl-Crypt-CBC-0:2.24-1.el3
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2 (RHEL3)
rhn-apache-0:1.3.27-36.rhn.rhel3
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2 (RHEL3)
rhn-modjk-0:1.2.23-2rhn.rhel3
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2 (RHEL3)
rhn-modperl-0:1.29-16.rhel3
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2 (RHEL3)
rhn-modssl-0:2.8.12-8.rhn.10.rhel3
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 4.2 (RHEL3)
tomcat5-0:5.0.30-0jpp_10rh
Fixed · RHSA-2008:0524
Red Hat Network Satellite Server v 5.0
jabberd-0:2.0s10-3.38.rhn
Fixed · RHSA-2008:0261
Red Hat Network Satellite Server v 5.0
java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4
Fixed · RHSA-2008:0261
Red Hat Network Satellite Server v 5.0
jfreechart-0:0.9.20-3.rhn
Fixed · RHSA-2008:0261
Red Hat Network Satellite Server v 5.0
openmotif21-0:2.1.30-11.RHEL4.6
Fixed · RHSA-2008:0261
Red Hat Network Satellite Server v 5.0
perl-Crypt-CBC-0:2.24-1.el4
Fixed · RHSA-2008:0261
Red Hat Network Satellite Server v 5.0
rhn-apache-0:1.3.27-36.rhn.rhel4
Fixed · RHSA-2008:0261
Red Hat Network Satellite Server v 5.0
rhn-modjk-0:1.2.23-2rhn.rhel4
Fixed · RHSA-2008:0261
Red Hat Network Satellite Server v 5.0
rhn-modperl-0:1.29-16.rhel4
Fixed · RHSA-2008:0261
Red Hat Network Satellite Server v 5.0
rhn-modssl-0:2.8.12-8.rhn.10.rhel4
Fixed · RHSA-2008:0261
Red Hat Network Satellite Server v 5.0
tomcat5-0:5.0.30-0jpp_10rh
Fixed · RHSA-2008:0261
Red Hat Network Satellite Server v 5.1
jfreechart-0:0.9.20-3.rhn
Fixed · RHSA-2008:0630
Red Hat Network Satellite Server v 5.1
mod_perl-0:2.0.2-12.el4
Fixed · RHSA-2008:0630
Red Hat Network Satellite Server v 5.1
perl-Crypt-CBC-0:2.24-1.el4
Fixed · RHSA-2008:0630
Red Hat Network Satellite Server v 5.1
rhn-web-0:5.1.1-7
Fixed · RHSA-2008:0630
Red Hat Network Satellite Server v 5.1
tomcat5-0:5.0.30-0jpp_10rh
Fixed · RHSA-2008:0630
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Application Server 3AS | n/a | Fixed | RHSA-2006:0592 |
| Red Hat Application Server v2 4AS | n/a | Fixed | RHSA-2006:0161 |
| Red Hat Network Satellite Server v 4.2 | jabberd-0:2.0s10-3.38.rhn | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 | java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4 | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 | jfreechart-0:0.9.20-3.rhn | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 | openmotif21-0:2.1.30-11.RHEL4.6 | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 | perl-Crypt-CBC-0:2.24-1.el4 | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 | rhn-apache-0:1.3.27-36.rhn.rhel4 | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 | rhn-modjk-0:1.2.23-2rhn.rhel4 | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 | rhn-modperl-0:1.29-16.rhel4 | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 | rhn-modssl-0:2.8.12-8.rhn.10.rhel4 | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 | tomcat5-0:5.0.30-0jpp_10rh | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 (RHEL3) | jabberd-0:2.0s10-3.37.rhn | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 (RHEL3) | java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el3 | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 (RHEL3) | jfreechart-0:0.9.20-3.rhn | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 (RHEL3) | openmotif21-0:2.1.30-9.RHEL3.8 | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 (RHEL3) | perl-Crypt-CBC-0:2.24-1.el3 | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 (RHEL3) | rhn-apache-0:1.3.27-36.rhn.rhel3 | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 (RHEL3) | rhn-modjk-0:1.2.23-2rhn.rhel3 | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 (RHEL3) | rhn-modperl-0:1.29-16.rhel3 | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 (RHEL3) | rhn-modssl-0:2.8.12-8.rhn.10.rhel3 | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 4.2 (RHEL3) | tomcat5-0:5.0.30-0jpp_10rh | Fixed | RHSA-2008:0524 |
| Red Hat Network Satellite Server v 5.0 | jabberd-0:2.0s10-3.38.rhn | Fixed | RHSA-2008:0261 |
| Red Hat Network Satellite Server v 5.0 | java-1.4.2-ibm-0:1.4.2.10-1jpp.2.el4 | Fixed | RHSA-2008:0261 |
| Red Hat Network Satellite Server v 5.0 | jfreechart-0:0.9.20-3.rhn | Fixed | RHSA-2008:0261 |
| Red Hat Network Satellite Server v 5.0 | openmotif21-0:2.1.30-11.RHEL4.6 | Fixed | RHSA-2008:0261 |
| Red Hat Network Satellite Server v 5.0 | perl-Crypt-CBC-0:2.24-1.el4 | Fixed | RHSA-2008:0261 |
| Red Hat Network Satellite Server v 5.0 | rhn-apache-0:1.3.27-36.rhn.rhel4 | Fixed | RHSA-2008:0261 |
| Red Hat Network Satellite Server v 5.0 | rhn-modjk-0:1.2.23-2rhn.rhel4 | Fixed | RHSA-2008:0261 |
| Red Hat Network Satellite Server v 5.0 | rhn-modperl-0:1.29-16.rhel4 | Fixed | RHSA-2008:0261 |
| Red Hat Network Satellite Server v 5.0 | rhn-modssl-0:2.8.12-8.rhn.10.rhel4 | Fixed | RHSA-2008:0261 |
| Red Hat Network Satellite Server v 5.0 | tomcat5-0:5.0.30-0jpp_10rh | Fixed | RHSA-2008:0261 |
| Red Hat Network Satellite Server v 5.1 | jfreechart-0:0.9.20-3.rhn | Fixed | RHSA-2008:0630 |
| Red Hat Network Satellite Server v 5.1 | mod_perl-0:2.0.2-12.el4 | Fixed | RHSA-2008:0630 |
| Red Hat Network Satellite Server v 5.1 | perl-Crypt-CBC-0:2.24-1.el4 | Fixed | RHSA-2008:0630 |
| Red Hat Network Satellite Server v 5.1 | rhn-web-0:5.1.1-7 | Fixed | RHSA-2008:0630 |
| Red Hat Network Satellite Server v 5.1 | tomcat5-0:5.0.30-0jpp_10rh | Fixed | RHSA-2008:0630 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
AV:N/AC:M/Au:N/C:N/I:P/A:N
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (13 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 3, 2026 | 32.25% (0.32247) | 98.28th | v5 (v2026.06.15) |
| Jun 15, 2026 | 31.60% (0.31601) | 98.06th | v5 (v2026.06.15) |
| May 13, 2025 | 45.81% (0.45806) | 97.45th | v4 (v2025.03.14) |
| Mar 30, 2025 | 40.04% (0.40044) | 97.05th | v4 (v2025.03.14) |
| Mar 29, 2025 | 43.93% (0.43932) | 96.34th | v4 (v2025.03.14) |
| Mar 17, 2025 | 40.04% (0.40044) | 97.01th | v4 (v2025.03.14) |
| Dec 25, 2024 | 1.32% (0.01323) | 85.69th | v3 (v2023.03.01) |
| May 9, 2024 | 0.16% (0.00161) | 52.44th | v3 (v2023.03.01) |
| Dec 8, 2023 | 0.18% (0.00176) | 54.63th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.18% (0.00184) | 53.83th | v3 (v2023.03.01) |
| Mar 6, 2023 | 17.05% (0.17051) | 96.21th | v2 (v2022.01.01) |
| Apr 1, 2022 | 17.05% (0.17051) | 95.85th | v2 (v2022.01.01) |
| Feb 4, 2022 | 17.05% (0.17051) | 93.02th | v2 (v2022.01.01) |
References (20)
- http://issues.apache.org/jira/browse/GERONIMO-1474 x_refsource_MISCExploitVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2008-0630.html vendor-advisoryx_refsource_REDHAT
- http://secunia.com/advisories/18485 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/31493 third-party-advisoryx_refsource_SECUNIA
- http://svn.apache.org/viewvc?view=revision&revision=372322
- http://www.oliverkarow.de/research/geronimo_css.txt x_refsource_MISCExploitVendor Advisory
- http://www.redhat.com/support/errata/RHSA-2008-0261.html vendor-advisoryx_refsource_REDHAT
- http://www.securityfocus.com/archive/1/421996/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/bid/16260 vdb-entryx_refsource_BIDExploit
- http://www.vupen.com/english/advisories/2006/0217 vdb-entryx_refsource_VUPEN
- https://access.redhat.com/security/cve/CVE-2006-0254 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=430646 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24158 vdb-entryx_refsource_XF
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24159 vdb-entryx_refsource_XF
- https://geronimo.apache.org/GMOxDOC11/release-notes-11txt.html
- https://github.com/advisories/GHSA-2jxh-3cx8-xw65 Advisory
- https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12310181&styleName=Html&projectId=10220&Create=Create x_refsource_CONFIRM
- https://issues.apache.org/jira/secure/attachment/12322088/GERONIMO-1474.patch
- https://nvd.nist.gov/vuln/detail/CVE-2006-0254
- https://www.cve.org/CVERecord?id=CVE-2006-0254
Change history (0)
No recorded changes yet.