CVE-2007-2449: Apache Tomcat examples web application JSP files XSS via URI path parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityThe flaw is a reflected XSS requiring user interaction and only affects the optional examples web application, but it is remotely reachable and has a high EPSS score.

What it is

Multiple cross-site scripting flaws exist in JSP files of the Apache Tomcat examples web application across versions 4.0.0-4.0.6, 4.1.0-4.1.36, 5.0.0-5.0.30, 5.5.0-5.5.24, and 6.0.0-6.0.13. Attackers can inject arbitrary script or HTML through the portion of the URI following a semicolon character, as shown by a URI containing "snp/snoop.jsp;". The issue matters because it enables script execution in a victim's browser context when the examples application is deployed and reachable.

Impact

An attacker can execute arbitrary script or HTML in the context of a victim's browser session against the affected Tomcat server. This can lead to session theft, credential harvesting, or defacement of content served to users of the examples application.

Attack surface

Reachable remotely over the network via crafted HTTP requests to JSP files in the Tomcat examples web application, specifically by appending a semicolon and payload to the URI. No authentication is required, but some user interaction is needed for the reflected script to execute in a victim's browser.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high at 0.77376 (99.5th percentile), but the reference tags provide no evidence of public exploit code or active exploitation.

What to do

• Upgrade to a fixed Tomcat release per the Apache Tomcat security pages for versions 4, 5, and 6.
• Remove or disable the examples web application from production Tomcat instances.
• Apply vendor errata from Red Hat, Apple, openSUSE, Mandriva, and HP where Tomcat is bundled.
• Restrict network access to the examples application and other non-essential Tomcat webapps.
• Deploy input validation or a WAF rule to block script content in URI path parameters after semicolons.

Detection

• Inspect HTTP access logs for requests to examples JSP files containing a semicolon followed by script or HTML payloads.
• Monitor for URIs matching patterns such as "snp/snoop.jsp;" or other examples paths with suspicious path parameters.
• Alert on reflected script content in responses from Tomcat examples web application endpoints.
• Review web server and WAF logs for repeated XSS probing against Tomcat example JSP files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.