Moderate severityNVD Advisory· Published Jul 25, 2007· Updated Jun 16, 2026
CVE-2007-3383
CVE-2007-3383
Description
Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.tomcat:tomcatMaven | >= 4.0.0, <= 4.0.6 | — |
org.apache.tomcat:tomcatMaven | >= 4.1.0, <= 4.1.36 | — |
Affected products
18cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*+ 16 more
- cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.15:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.28:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.31:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.36:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
21- seclists.org/fulldisclosure/2007/Jul/0448.htmlnvdPatchWEB
- tomcat.apache.org/security-4.htmlnvdPatchWEB
- www.kb.cert.org/vuls/id/862600nvdPatchUS Government ResourceWEB
- github.com/advisories/GHSA-wjwr-3jch-479jghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2007-3383ghsaADVISORY
- lists.apple.com/archives/security-announce/2008//Jun/msg00002.htmlnvdWEB
- support.apple.com/kb/HT2163nvdWEB
- exchange.xforce.ibmcloud.com/vulnerabilities/35536nvdWEB
- lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3EghsaWEB
- lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3EghsaWEB
- lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3EghsaWEB
- osvdb.org/39000nvd
- secunia.com/advisories/30802nvd
- securityreason.com/securityalert/2918nvd
- www.securityfocus.com/archive/1/474413/100/0/threadednvd
- www.securityfocus.com/bid/24999nvd
- www.vupen.com/english/advisories/2007/2618nvd
- www.vupen.com/english/advisories/2008/1981/referencesnvd
- lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3Envd
- lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3Envd
- lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3Envd
News mentions
0No linked articles in our index yet.