CVE-2009-0781
Summary
| CVE | CVE-2009-0781 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-03-09 21:30:00 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Tomcat | 4.1.0 | All | All | All |
| Application | Apache | Tomcat | 4.1.1 | All | All | All |
| Application | Apache | Tomcat | 4.1.10 | All | All | All |
| Application | Apache | Tomcat | 4.1.11 | All | All | All |
| Application | Apache | Tomcat | 4.1.12 | All | All | All |
| Application | Apache | Tomcat | 4.1.13 | All | All | All |
| Application | Apache | Tomcat | 4.1.14 | All | All | All |
| Application | Apache | Tomcat | 4.1.15 | All | All | All |
| Application | Apache | Tomcat | 4.1.16 | All | All | All |
| Application | Apache | Tomcat | 4.1.17 | All | All | All |
| Application | Apache | Tomcat | 4.1.18 | All | All | All |
| Application | Apache | Tomcat | 4.1.19 | All | All | All |
| Application | Apache | Tomcat | 4.1.2 | All | All | All |
| Application | Apache | Tomcat | 4.1.20 | All | All | All |
| Application | Apache | Tomcat | 4.1.21 | All | All | All |
| Application | Apache | Tomcat | 4.1.22 | All | All | All |
| Application | Apache | Tomcat | 4.1.23 | All | All | All |
| Application | Apache | Tomcat | 4.1.24 | All | All | All |
| Application | Apache | Tomcat | 4.1.25 | All | All | All |
| Application | Apache | Tomcat | 4.1.26 | All | All | All |
| Application | Apache | Tomcat | 4.1.27 | All | All | All |
| Application | Apache | Tomcat | 4.1.28 | All | All | All |
| Application | Apache | Tomcat | 4.1.29 | All | All | All |
| Application | Apache | Tomcat | 4.1.3 | All | All | All |
| Application | Apache | Tomcat | 4.1.3 | beta | All | All |
| Application | Apache | Tomcat | 4.1.30 | All | All | All |
| Application | Apache | Tomcat | 4.1.31 | All | All | All |
| Application | Apache | Tomcat | 4.1.32 | All | All | All |
| Application | Apache | Tomcat | 4.1.33 | All | All | All |
| Application | Apache | Tomcat | 4.1.34 | All | All | All |
| Application | Apache | Tomcat | 4.1.35 | All | All | All |
| Application | Apache | Tomcat | 4.1.36 | All | All | All |
| Application | Apache | Tomcat | 4.1.37 | All | All | All |
| Application | Apache | Tomcat | 4.1.4 | All | All | All |
| Application | Apache | Tomcat | 4.1.5 | All | All | All |
| Application | Apache | Tomcat | 4.1.6 | All | All | All |
| Application | Apache | Tomcat | 4.1.7 | All | All | All |
| Application | Apache | Tomcat | 4.1.8 | All | All | All |
| Application | Apache | Tomcat | 4.1.9 | All | All | All |
| Application | Apache | Tomcat | 4.1.9 | beta | All | All |
| Application | Apache | Tomcat | 5.5.0 | All | All | All |
| Application | Apache | Tomcat | 5.5.1 | All | All | All |
| Application | Apache | Tomcat | 5.5.10 | All | All | All |
| Application | Apache | Tomcat | 5.5.11 | All | All | All |
| Application | Apache | Tomcat | 5.5.12 | All | All | All |
| Application | Apache | Tomcat | 5.5.13 | All | All | All |
| Application | Apache | Tomcat | 5.5.14 | All | All | All |
| Application | Apache | Tomcat | 5.5.15 | All | All | All |
| Application | Apache | Tomcat | 5.5.16 | All | All | All |
| Application | Apache | Tomcat | 5.5.17 | All | All | All |
| Application | Apache | Tomcat | 5.5.18 | All | All | All |
| Application | Apache | Tomcat | 5.5.19 | All | All | All |
| Application | Apache | Tomcat | 5.5.2 | All | All | All |
| Application | Apache | Tomcat | 5.5.20 | All | All | All |
| Application | Apache | Tomcat | 5.5.21 | All | All | All |
| Application | Apache | Tomcat | 5.5.22 | All | All | All |
| Application | Apache | Tomcat | 5.5.23 | All | All | All |
| Application | Apache | Tomcat | 5.5.24 | All | All | All |
| Application | Apache | Tomcat | 5.5.25 | All | All | All |
| Application | Apache | Tomcat | 5.5.26 | All | All | All |
| Application | Apache | Tomcat | 5.5.3 | All | All | All |
| Application | Apache | Tomcat | 5.5.4 | All | All | All |
| Application | Apache | Tomcat | 5.5.5 | All | All | All |
| Application | Apache | Tomcat | 5.5.6 | All | All | All |
| Application | Apache | Tomcat | 5.5.7 | All | All | All |
| Application | Apache | Tomcat | 5.5.8 | All | All | All |
| Application | Apache | Tomcat | 5.5.9 | All | All | All |
| Application | Apache | Tomcat | 6.0 | All | All | All |
| Application | Apache | Tomcat | 6.0.0 | All | All | All |
| Application | Apache | Tomcat | 6.0.1 | All | All | All |
| Application | Apache | Tomcat | 6.0.10 | All | All | All |
| Application | Apache | Tomcat | 6.0.11 | All | All | All |
| Application | Apache | Tomcat | 6.0.12 | All | All | All |
| Application | Apache | Tomcat | 6.0.13 | All | All | All |
| Application | Apache | Tomcat | 6.0.14 | All | All | All |
| Application | Apache | Tomcat | 6.0.15 | All | All | All |
| Application | Apache | Tomcat | 6.0.16 | All | All | All |
| Application | Apache | Tomcat | 6.0.2 | All | All | All |
| Application | Apache | Tomcat | 6.0.3 | All | All | All |
| Application | Apache | Tomcat | 6.0.4 | All | All | All |
| Application | Apache | Tomcat | 6.0.5 | All | All | All |
| Application | Apache | Tomcat | 6.0.6 | All | All | All |
| Application | Apache | Tomcat | 6.0.7 | All | All | All |
| Application | Apache | Tomcat | 6.0.8 | All | All | All |
| Application | Apache | Tomcat | 6.0.9 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| '[security bulletin] HPSBUX02579 SSRT100203 rev.1 - HP-UX Apache Running Tomcat Servlet Engine, Remot' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| VMware Products Update for Multiple Packages - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Debian -- Security Information -- DSA-2207-1 tomcat5.5 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| '[security bulletin] HPSBMA02535 SSRT100029 rev.1 - HP Performance Manager, Remote Unauthorized Acces' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Apache Tomcat® - Apache Tomcat 4.x vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | tomcat.apache.org | Vendor Advisory |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| HP-UX update for Tomcat Servlet Engine - Advisories - Community | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Security Advisories | Mandriva Linux | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| [SECURITY] Fedora 11 Update: tomcat6-6.0.20-1.fc11 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| [SECURITY] Fedora 10 Update: tomcat6-6.0.20-1.fc10 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| '[security bulletin] HPSBUX02860 SSRT101146 rev.1 - HP-UX Apache Running Tomcat Servlet Engine, Remot' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| Security Advisories | Mandriva Linux | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Sun Solaris Tomcat Multiple Vulnerabilities - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| [SECURITY] Fedora 12 Update: tomcat6-6.0.20-1.fc12 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| APPLE-SA-2010-03-29-1 Security Update 2010-002 / Mac OS X v10.6.3 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | |
| Apache Tomcat - Apache Tomcat 5 vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | tomcat.apache.org | Vendor Advisory |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| sunsolve.sun.com/search/document.do | af854a3a-2127-422b-91ae-364da2661108 | sunsolve.sun.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| About the security content of Security Update 2010-002 / Mac OS X v10.6.3 | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| Apache Tomcat® - Apache Tomcat 6 vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | tomcat.apache.org | Vendor Advisory |
| VMSA-2009-0016.1 | af854a3a-2127-422b-91ae-364da2661108 | www.vmware.com | |
| '[security bulletin] HPSBOV02762 SSRT100825 rev.1 - HP Secure Web Server (SWS) for OpenVMS running CS' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| SUSE Update for Multiple Packages - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| [security-announce] SUSE Security Summary Report: SUSE-SR:2009:012 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Red Hat Customer Portal | MITRE | access.redhat.com | |
| Red Hat Customer Portal | MITRE | access.redhat.com | |
| CVE-2009-0781 - Red Hat Customer Portal | MITRE | access.redhat.com | |
| 489028 – (CVE-2009-0781) CVE-2009-0781 tomcat: XSS in Apache Tomcat calendar application | MITRE | bugzilla.redhat.com | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2009-03-17 | Tomas Hoger | Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2009-0781 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/ |
There are currently no legacy QID mappings associated with this CVE.