CVE-2026-50229 Apache Tomcat

Comments

Rule Name: Cross-Site Scripting (XSS) rule

Tomcat's number guess example page copies every request parameter onto its bean, including an internal hint value, and prints it back into the page without escaping. A link to /examples/jsp/num/numguess.jsp with a script in the hint parameter therefore runs that script in the browser of whoever clicks it. In the Portal's Rules Wizard, add a Cross-Site Scripting (XSS) rule whose endpoint covers /examples/jsp/num/numguess.jsp (or every endpoint), with HTTP request parameters as a trust source, the strictest policy and the action set to Protect. The rule follows the request value into the HTML the page writes and blocks the response when that value adds any tag or attribute, so it catches whatever payload the attacker picks, not just the published <script> one. That still holds when the value is stored in the session and shown again on a later visit, because the value keeps its taint. The rule does nothing about a visitor setting the game's other internal values, which only lets them cheat at the example game, and removing the examples web application from production servers closes the hole as well.