Apache Tomcat's CookieExample Vulnerable to XSS
Date: 2022-05
Affected: maven/org.apache.tomcat:tomcat
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2007-3384
CWE: CWE-80

Multiple cross-site scripting (XSS) vulnerabilities in `examples/servlet/CookieExample` in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Value field, related to error messages.


Mitigations:

Architectural layers (MAESTRO):