CVE ID:	CVE-2007-3383
Description:	Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.
Test IDs:	None available
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2007-3383 http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html BugTraq ID: 24999 http://www.securityfocus.com/bid/24999 Bugtraq: 20070721 CVE-2007-3383: XSS in Tomcat send mail example (Google Search) http://www.securityfocus.com/archive/1/474413/100/0/threaded CERT/CC vulnerability note: VU#862600 http://www.kb.cert.org/vuls/id/862600 http://seclists.org/fulldisclosure/2007/Jul/0448.html https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E http://osvdb.org/39000 http://secunia.com/advisories/30802 http://securityreason.com/securityalert/2918 http://www.vupen.com/english/advisories/2007/2618 http://www.vupen.com/english/advisories/2008/1981/references XForce ISS Database: tomcat-sendmail-example-xss(35536) https://exchange.xforce.ibmcloud.com/vulnerabilities/35536