How severe is CVE-2007-1358?

No CVSS score has been assigned to CVE-2007-1358 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by CVE-2007-1358?

CVE-2007-1358 affects the following packages: org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat (Maven). Ecosystems affected: Maven.

How do I fix CVE-2007-1358?

The records we use list no patched version of org.apache.tomcat:tomcat for CVE-2007-1358. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.

How do I detect CVE-2007-1358 in my Maven dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.tomcat:tomcat, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2007-1358 if there is no patch (or I can't update yet)?

Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Is CVE-2007-1358 actively exploited in the wild?

No public exploit code has been indexed for CVE-2007-1358 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2007-1358?

CVE-2007-1358 has an EPSS (Exploit Prediction Scoring System) score of 19.9%, placing it in the 97th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score warrants monitoring and prompt remediation.

What type of vulnerability is CVE-2007-1358?

CVE-2007-1358 is classified as Cross-site Scripting (XSS) (CWE-79). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure.

When was CVE-2007-1358 published, and has it been updated?

CVE-2007-1358 was published on May 1, 2022 and was last updated on November 8, 2023. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

☕ Maven

Not in CISA KEV

CVE-2007-1358 — tomcat

CVE-2007-1358 is a Cross-site Scripting (XSS) vulnerability in org.apache.tomcat:tomcat. EPSS puts its 30-day exploitation probability at 19.9% (97th percentile). The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.

Apache Tomcat XSS In Accept-Language Headers

Published

May 1, 2022

Updated

Nov 8, 2023

Affected

2 pkgs

Patched

See advisory

Exploits

None indexed

Exploitation data as of Oct 29, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗

19.9%probability of exploitation in next 30 days

Moderate Risk0.00%

Lower risk than most CVEs97th percentile — riskier than 97% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

2 pkgs affected

☕org.apache.tomcat:tomcat☕org.apache.tomcat:tomcat

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

Affected Packages

2 total

Ecosystem	Package	Vulnerable range	Fix
☕Maven	`org.apache.tomcat:tomcat`	≥ 4.0.0	No fix
☕Maven	`org.apache.tomcat:tomcat`	≥ 4.1.0	No fix

Affected Products

1 product · 9 configurations

Application

tomcatapache

≤ 4.1.31

8 versions

4.0.04.0.14.0.24.0.34.0.44.0.54.0.64.1.0

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.tomcat:tomcat, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
The records we use list no patched version of org.apache.tomcat:tomcat for CVE-2007-1358. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.
Mitigate without a patch
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatLow

Product	Fixed in	Advisory
Red Hat Certificate System 7.3	`ant-0:1.6.5-1jpp_1rh`	RHSA-2010:0602
Red Hat Developer Suite V.3	`jakarta-commons-modeler-0:2.0-3jpp_3rh`	RHSA-2007:0328
Red Hat Enterprise Linux 5	`jakarta-commons-modeler-0:1.1-8jpp.1.0.2.el5`	RHSA-2007:0327
Red Hat Network Satellite Server v 4.2	`jabberd-0:2.0s10-3.38.rhn`	RHSA-2008:0524
Red Hat Network Satellite Server v 5.0	`jabberd-0:2.0s10-3.38.rhn`	RHSA-2008:0261
Red Hat Network Satellite Server v 5.1	`jfreechart-0:0.9.20-3.rhn`	RHSA-2008:0630
Red Hat Web Application Stack for RHEL 4	`jbossas-0:4.0.5-2.CP04.el4s1.2`	RHSA-2007:0360
RHAPS Version 2 for RHEL 4	`jakarta-commons-modeler-0:2.0-3jpp_2rh`	RHSA-2007:0326

Frequently Asked Questions

O3 Security · Impact-Aware SCA

Is CVE-2007-1358 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works