Executive brief
A cross-site scripting (XSS) vulnerability exists in the 'number guess' example application bundled with Apache Tomcat. While this is a sample application and not part of the core server functionality, if it is deployed on a production server, an attacker could potentially execute malicious scripts in a user's browser. This could lead to unauthorized actions being performed in the context of the user's session.
Technical details
A basic Cross-Site Scripting (XSS) vulnerability (CWE-80) exists in the 'number guess' example application included with various versions of Apache Tomcat. The vulnerability stems from the improper neutralization of script-related HTML tags within the web page, allowing an attacker to inject and execute malicious scripts in the context of a victim's browser session. This is a network-based attack that typically requires a user to interact with a malicious link or visit a compromised page. The issue affects multiple major versions including 7.x, 8.x, 9.x, 10.x, and 11.x. Users are advised to upgrade to versions 11.0.23, 10.1.56, 9.0.119, or later to resolve the issue.
Affected products
- Apache Tomcat 11.0.0-M1 to 11.0.22, 10.1.0-M1 to 10.1.55, 9.0.0.M1 to 9.0.118, 8.5.0 to 8.5.100, 7.0.0 to 7.0.109
Timeline
- 2026-06-29: disclosed
- 2026-06-29: advisory