CVE-2007-3386: Apache Tomcat Host Manager Servlet XSS via aliases parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityThe flaw is a reflected XSS in an administrative interface with medium CVSS severity and no confirmed exploitation, though the high EPSS score warrants timely patching.

What it is

The Host Manager Servlet in Apache Tomcat 6.0.0 through 6.0.13 and 5.5.0 through 5.5.24 reflects crafted input, demonstrated through the aliases parameter to an html/add action, allowing arbitrary HTML and script injection. This is a reflected cross-site scripting flaw in an administrative web interface, so it matters mainly where the Host Manager is reachable and an operator can be lured into a crafted request.

Impact

An attacker can execute script in the context of a victim's browser session against the Tomcat Host Manager, potentially stealing session data or performing actions as the victim. The CVSS 2.0 vector shows partial integrity impact only, with no confidentiality or availability impact.

Attack surface

Reachable over the network through crafted HTTP requests to the Host Manager Servlet, specifically the aliases parameter of an html/add action. The CVSS vector indicates no authentication is required (Au:N), but some user interaction is implied by the medium access complexity and the XSS nature of the flaw.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded. EPSS is high at roughly 0.59 probability over 30 days (99th percentile), but the reference list contains no exploit-tagged entries, so active exploitation is not confirmed by this record.

What to do

• Upgrade Tomcat to a release after 6.0.13 or 5.5.24; the Apache Tomcat security page is tagged as the patch reference.
• If the Host Manager is not needed, remove or disable it, and restrict access to it by network controls and authentication.
• Apply vendor errata from Red Hat, Debian, Mandriva, openSUSE, HP and CA where Tomcat is bundled.
• Deploy input validation and output encoding for the Host Manager interface, or place it behind a reverse proxy that filters script-bearing parameters.

Detection

• Inspect web and proxy logs for requests to the Host Manager with html/add actions and suspicious aliases parameter values containing script or HTML.
• Alert on script tags or event handler attributes in query strings and form data reaching Tomcat management endpoints.
• Monitor for unexpected access to the Host Manager from untrusted networks or unauthenticated clients.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.