CVE-2008-1232: Apache Tomcat XSS via sendError message argument

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityThe CVSS 2.0 base score is 4.3 (medium) with partial integrity impact only, and there is no KEV listing or documented exploitation despite a high EPSS score.

What it is

Apache Tomcat versions 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 do not properly neutralize a crafted string passed as the message argument to HttpServletResponse.sendError, resulting in reflected cross-site scripting. An attacker who can influence that message can cause arbitrary script or HTML to be rendered in a victim's browser in the context of the affected site.

Impact

An attacker can execute script in a victim's browser session, enabling session theft, credential capture, or page content manipulation within the vulnerable application's origin.

Attack surface

Reachable remotely over the network (AV:N) with no authentication required (Au:N); exploitation requires the victim to load a crafted link or page (AC:M), and the flaw is triggered through the sendError message argument.

Exploitation

Not listed in CISA KEV and no ransomware usage documented; EPSS is high (0.75865, 99.5th percentile), but the reference tags are advisory and mailing-list links only, with no public exploit tag.

What to do

• Upgrade Tomcat to a release later than 4.1.37, 5.5.26, or 6.0.16, or to a currently supported branch.
• Apply vendor or distribution patches for Tomcat and any bundled third-party products listed in the advisories.
• Ensure the sendError message argument is not populated from untrusted request input, or HTML-encode it before use.
• Deploy output encoding and a Content-Security-Policy to reduce script execution if injection occurs.

Detection

• Search web and proxy logs for requests whose parameters or paths appear in Tomcat error responses containing script or HTML markup.
• Monitor for reflected input in HTTP error pages generated by sendError, especially unusual query strings or headers.
• Review application code and server configuration for sendError calls that pass user-controlled strings.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.