CVE-2007-3386
Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6...
4.3 MediumPublic exploit
Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
Exploit likelihood
59.0%Down 6.3 points since Feb 4, 2022
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
- Record
CVE-2007-3386- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
- Record
CVE-2007-3386- Updated
- 2026-11-02
EUVDEUVD-2007-3372 No score
Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
- Record
EUVD-2007-3372- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v66v-63h2-8q5q No score
Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6...
Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
- Record
GHSA-v66v-63h2-8q5q- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tomcat5.5Debian:4.0 From an advisory covering 5 CVEs |
before 5.5.20-2etch1, plus listed versions 5.5.20-2 |
5.5.20-2etch1 |
tomcat5Red Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-common-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-jasperRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-server-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat5-webappsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5Red Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5Red Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-common-libRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-jasperRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-server-libRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5-webappsRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs |
before 0:5.5.23-0jpp.3.0.2.el5 | 0:5.5.23-0jpp.3.0.2.el5 |
tomcat5Red Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-admin-webappsRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-common-libRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-jasperRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-jasper-javadocRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-jsp-2.0-apiRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-jsp-2.0-api-javadocRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-server-libRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-servlet-2.4-apiRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-servlet-2.4-api-javadocRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-webappsRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Tomcat 6.0.13 - Host Manager Servlet Cross-Site Scripting | 2007-08-14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| affected, aliases, exploits, facts, references, title | Exploit-DB, GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-3386 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published August 14, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 59.0%, the 99th percentile. No source names a fixed version.
References
osvdb.org/36417
redhat.com/archives/fedora-package-announce/2007-November/msg00525.html
secunia.com/advisories/27267
vupen.com/english/advisories/2007/3527
jvn.jp/jp/JVN%2359851336/index.html
exchange.xforce.ibmcloud.com/vulnerabilities/36001
Show 57 moreShow less
securityfocus.com/bid/25314
securitytracker.com/id?1018558
securityreason.com/securityalert/3010
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554
lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
tomcat.apache.org/security-6.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10077
debian.org/security/2008/dsa-1447
community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
mandriva.com/security/advisories?name=MDKSA-2007:241
nvd.nist.gov/vuln/detail/CVE-2007-3386
github.com/advisories/GHSA-v66v-63h2-8q5q
access.redhat.com/errata/RHSA-2007:0871
bugzilla.redhat.com/show_bug.cgi?id=247972
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0871.json
cve.org/CVERecord?id=CVE-2007-3382