CVE-2008-1947
Apache Tomcat Cross-site scripting (XSS) vulnerability
4.3 MediumFix available
Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
Exploit likelihood
9.78%Up 2.4 points since Feb 4, 2022
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
- Record
CVE-2008-1947- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
- Record
CVE-2008-1947- Updated
- 2026-11-02
EUVDEUVD-2022-3733 No score
Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
- Record
EUVD-2022-3733- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f98p-9pp6-7q6c
Apache Tomcat Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
- Record
GHSA-f98p-9pp6-7q6c- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-f98p-9pp6-7q6c
Apache Tomcat Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
- Record
GHSA-f98p-9pp6-7q6c- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
5.5.9 to 5.5.26 | 5.5.27 |
org.apache.tomcat:tomcatMaven |
6.0.0 to 6.0.16 | 6.0.18 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
5.5.9 to 5.5.26 | 5.5.27 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
6.0.0 to 6.0.16 | 6.0.18 |
tomcat5.5Debian:4.0 |
before 5.5.20-2etch3, plus listed versions 5.5.20-25.5.20-2etch15.5.20-2etch2 |
5.5.20-2etch3 |
org.apache.tomcat:tomcatMaven |
5.5.9 up to 5.5.27 | 5.5.27 |
org.apache.tomcat:tomcatMaven |
6.0.0 up to 6.0.18 | 6.0.18 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
5.5.9 up to 5.5.27 | 5.5.27 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
6.0.0 up to 6.0.18 | 6.0.18 |
tomcat5Red Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
Show 44 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat5-admin-webappsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-common-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jasperRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-server-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-webappsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5Red Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5Red Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-common-libRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jasperRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-server-libRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5-webappsRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.7.el5_2.1 | 0:5.5.23-0jpp.7.el5_2.1 |
tomcat5Red Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-admin-webappsRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-common-libRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-jasperRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-jasper-javadocRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-jsp-2.0-apiRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-jsp-2.0-api-javadocRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-server-libRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-servlet-2.4-apiRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-servlet-2.4-api-javadocRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5-webappsRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.9 | 0:5.5.23-0jpp_4rh.9 |
tomcat5Red Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_12rh | 0:5.5.23-0jpp_12rh |
tomcat5-common-libRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_12rh | 0:5.5.23-0jpp_12rh |
tomcat5-jasperRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_12rh | 0:5.5.23-0jpp_12rh |
tomcat5-jsp-2.0-apiRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_12rh | 0:5.5.23-0jpp_12rh |
tomcat5-server-libRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_12rh | 0:5.5.23-0jpp_12rh |
tomcat5-servlet-2.4-apiRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_12rh | 0:5.5.23-0jpp_12rh |
tomcat5Red Hat:network_satellite:5.1::el4 From an advisory covering 5 CVEs |
before 0:5.0.30-0jpp_12rh | 0:5.0.30-0jpp_12rh |
tomcat5Red Hat:network_satellite:5.0:el4 From an advisory covering 5 CVEs |
before 0:5.0.30-0jpp_12rh | 0:5.0.30-0jpp_12rh |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1947 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published June 4, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.78%, the 95th percentile. Fixed in org.apache.tomcat:tomcat 5.5.27.
References
securityfocus.com/archive/1/492958/100/0/threaded
secunia.com/advisories/30500
redhat.com/support/errata/RHSA-2008-0862.html
marc.info?l=tomcat-user&m=121244319501278&w=2
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6009
Show 95 moreShow less
vupen.com/english/advisories/2008/2823
exchange.xforce.ibmcloud.com/vulnerabilities/42816
vmware.com/security/advisories/VMSA-2009-0002.html
mandriva.com/security/advisories?name=MDVSA-2008:188
support.avaya.com/elmodocs2/security/ASA-2008-401.htm
lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
tomcat.apache.org/security-6.html
securitytracker.com/id?1020624
lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
support.apple.com/kb/HT3216
debian.org/security/2008/dsa-1593
lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2008-1947
access.redhat.com/errata/RHSA-2008:0648
bugzilla.redhat.com/show_bug.cgi?id=446393
github.com/apache/tomcat/commit/5f00d434c8dc11bd49ce0b4b56fe889839056030
web.archive.org/web/20200514224656/http://www.securityfocus.com/archive/1/507985/100/0/threaded
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0648.json
cve.org/CVERecord?id=CVE-2008-1232