CVE-2007-2449
Apache Tomcat XSS Vulnerabilities in Examples Web Application
4.3 MediumPublic exploit
Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.
Exploit likelihood
77.4%Up 7.1 points since Feb 4, 2022
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.
- Record
CVE-2007-2449- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.
- Record
CVE-2007-2449- Updated
- 2026-11-02
EUVDEUVD-2022-4122 No score
Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.
- Record
EUVD-2022-4122- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hc39-rjwp-qffq No score
Apache Tomcat XSS Vulnerabilities in Examples Web Application
Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ; character, as demonstrated by a URI containing a snp/snoop.jsp; sequence.
- Record
GHSA-hc39-rjwp-qffq- Updated
- 2026-11-02
OSVGHSA-hc39-rjwp-qffq No score
Apache Tomcat XSS Vulnerabilities in Examples Web Application
Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ; character, as demonstrated by a URI containing a snp/snoop.jsp; sequence.
- Record
GHSA-hc39-rjwp-qffq- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
4.0.0 to 4.0.6 | None known |
org.apache.tomcat:tomcatMaven |
5.0.0 to 5.0.30 | None known |
org.apache.tomcat:tomcatMaven |
5.5.0 to 5.5.24 | None known |
org.apache.tomcat:tomcatMaven |
6.0.0 to 6.0.13 | None known |
tomcat5Red Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-common-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-jasperRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
Show 73 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-server-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-webappsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5Red Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5Red Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-common-libRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-jasperRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-server-libRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5-webappsRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:5.5.23-0jpp.1.0.4.el5 | 0:5.5.23-0jpp.1.0.4.el5 |
tomcat5Red Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-admin-webappsRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-common-libRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-jasperRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-jasper-javadocRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-jsp-2.0-apiRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-jsp-2.0-api-javadocRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-server-libRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-servlet-2.4-apiRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-servlet-2.4-api-javadocRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
tomcat5-webappsRed Hat:rhel_application_server:2 From an advisory covering 6 CVEs |
before 0:5.5.23-0jpp_4rh.4 | 0:5.5.23-0jpp_4rh.4 |
jabberdRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.0s10-3.38.rhn | 0:2.0s10-3.38.rhn |
java-1.4.2-ibmRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
java-1.4.2-ibm-develRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
jfreechartRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
openmotif21-debuginfoRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
perl-Crypt-CBCRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.24-1.el4 | 0:2.24-1.el4 |
rhn-apacheRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.3.27-36.rhn.rhel4 | 0:1.3.27-36.rhn.rhel4 |
rhn-modjk-ap13Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.2.23-2rhn.rhel4 | 0:1.2.23-2rhn.rhel4 |
rhn-modperlRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.29-16.rhel4 | 0:1.29-16.rhel4 |
rhn-modsslRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.8.12-8.rhn.10.rhel4 | 0:2.8.12-8.rhn.10.rhel4 |
tomcat5Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
jabberdRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.0s10-3.37.rhn | 0:2.0s10-3.37.rhn |
java-1.4.2-ibmRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el3 | 0:1.4.2.10-1jpp.2.el3 |
java-1.4.2-ibm-develRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el3 | 0:1.4.2.10-1jpp.2.el3 |
jfreechartRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.1.30-9.RHEL3.8 | 0:2.1.30-9.RHEL3.8 |
openmotif21-debuginfoRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.1.30-9.RHEL3.8 | 0:2.1.30-9.RHEL3.8 |
perl-Crypt-CBCRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.24-1.el3 | 0:2.24-1.el3 |
rhn-apacheRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.3.27-36.rhn.rhel3 | 0:1.3.27-36.rhn.rhel3 |
rhn-modjk-ap13Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.2.23-2rhn.rhel3 | 0:1.2.23-2rhn.rhel3 |
rhn-modperlRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.29-16.rhel3 | 0:1.29-16.rhel3 |
rhn-modsslRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.8.12-8.rhn.10.rhel3 | 0:2.8.12-8.rhn.10.rhel3 |
tomcat5Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
jabberdRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.0s10-3.38.rhn | 0:2.0s10-3.38.rhn |
java-1.4.2-ibmRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
java-1.4.2-ibm-develRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
jfreechartRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
openmotif21-debuginfoRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
perl-Crypt-CBCRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.24-1.el4 | 0:2.24-1.el4 |
rhn-apacheRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.3.27-36.rhn.rhel4 | 0:1.3.27-36.rhn.rhel4 |
rhn-modjk-ap13Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.2.23-2rhn.rhel4 | 0:1.2.23-2rhn.rhel4 |
rhn-modperlRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.29-16.rhel4 | 0:1.29-16.rhel4 |
rhn-modsslRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.8.12-8.rhn.10.rhel4 | 0:2.8.12-8.rhn.10.rhel4 |
tomcat5Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
jfreechartRed Hat:network_satellite:5.1::el4 From an advisory covering 11 CVEs |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
mod_perlRed Hat:network_satellite:5.1::el4 From an advisory covering 11 CVEs |
before 0:2.0.2-12.el4 | 0:2.0.2-12.el4 |
mod_perl-debuginfoRed Hat:network_satellite:5.1::el4 From an advisory covering 11 CVEs |
before 0:2.0.2-12.el4 | 0:2.0.2-12.el4 |
perl-Crypt-CBCRed Hat:network_satellite:5.1::el4 From an advisory covering 11 CVEs |
before 0:2.24-1.el4 | 0:2.24-1.el4 |
rhn-htmlRed Hat:network_satellite:5.1::el4 From an advisory covering 11 CVEs |
before 0:5.1.1-7 | 0:5.1.1-7 |
tomcat5Red Hat:network_satellite:5.1::el4 From an advisory covering 11 CVEs |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Tomcat 6.0.13 - JSP Example Web Applications Cross-Site Scripting | 2007-06-14 |
| Nuclei | Apache Tomcat 4.x-7.x - Cross-Site Scripting |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| affected, aliases, exploits, facts, references, title | Exploit-DB, GitHub Advisories, Nuclei, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-2449 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published June 14, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 77.4%, the 99th percentile. No source names a fixed version.
References
tomcat.apache.org/security-4.html
support.apple.com/kb/HT2163
rhn.redhat.com/errata/RHSA-2008-0630.html
vupen.com/english/advisories/2008/1981/references
redhat.com/archives/fedora-package-announce/2007-November/msg00525.html
securityfocus.com/bid/24476
Show 194 moreShow less
secunia.com/advisories/31493
securityreason.com/securityalert/2804
exchange.xforce.ibmcloud.com/vulnerabilities/34869
securitytracker.com/id?1018245
lists.opensuse.org/opensuse-security-announce/2008-03/msg00008.html
lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
osvdb.org/36080
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10578
community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
mandriva.com/security/advisories?name=MDKSA-2007:241
lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2007-2449
github.com/advisories/GHSA-hc39-rjwp-qffq
access.redhat.com/errata/RHSA-2007:0569
bugzilla.redhat.com/show_bug.cgi?id=244804
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0569.json
cve.org/CVERecord?id=CVE-2007-2449
This page doesn't list everything
Left out here: 21 references. The JSON record has them.