XSS Vulnerability in Apache TomEE Console Affects Web Application
CVE-2018-8031

6.1MEDIUM

Key Information:

Vendor
Apache
Status
Apache Tomee
Vendor
CVE Published:
23 July 2018

Summary

The Apache TomEE console, known as tomee-webapp, is vulnerable to cross-site scripting (XSS) attacks. This vulnerability arises when a user is tricked into visiting a malicious URL, potentially leading to the execution of arbitrary JavaScript in their browser. Although this application is not included in the default TomEE bundles, if it is utilized during setup, there is a risk. To mitigate this vulnerability, users are advised to remove the application post-installation, utilize one of the pre-configured bundles, or upgrade to TomEE version 7.0.5, where the issue has been resolved.

Affected Version(s)

Apache TomEE < 7.0.5

References

https://lists.apache.org/thread.html/c4b0d83a534d6cdf2de5...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.