---
title: "CVE-2008-1947\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2008-1947?format=md
keywords: index, follow
---

# CVE-2008-1947

Publication date 4 June 2008

Last updated 17 July 2025

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

Toggle side navigation

## Description

Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through
5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary
web script or HTML via the name parameter (aka the hostname attribute) to
host-manager/html/add.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| tomcat5 | 9.10 karmic | Not in release |
| 9.04 jaunty | Not in release |
| 8.10 intrepid | Not in release |
| 8.04 LTS hardy | Not in release |
| 7.10 gutsy | Not in release |
| 7.04 feisty | Ignored end of life, was needs-triage |
| 6.06 LTS dapper | Ignored end of life |
| tomcat5.5 | 9.10 karmic | Not in release |
| 9.04 jaunty | Not affected |
| 8.10 intrepid | Not affected |
| 8.04 LTS hardy | Fixed 5.5.25-5ubuntu1.1 |
| 7.10 gutsy | Ignored end of life, was needed |
| 7.04 feisty | Ignored end of life, was needed |
| 6.06 LTS dapper | Not in release |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2008-1947?format=md#patch-details)

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| tomcat5.5 | * Debdiff:   <http://launchpad.net/bugs/270553> |

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1947)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2008-1947)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2008-1947)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2008-1947)

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2008-1947>