This vulnerability is a basic Cross-Site Scripting (XSS) issue categorized under CWE-80, caused by improper neutralization of script-related HTML tags in the number guess example application within Apache Tomcat. It affects a range of Apache Tomcat versions from 7.0.0 up to but not including 7.0.110, 8.5.0 up to but not including 8.5.101, 9.0.0.M1 through 9.0.118, 10.1.0-M1 through 10.1.55, and 11.0.0-M1 through 11.0.22. The vulnerability allows injection of malicious scripts due to insufficient sanitization of HTML content. The vendor has released fixed versions 11.0.23, 10.1.56, and 9.0.119 that resolve this issue. No CVSS score is provided, and there is no indication of known exploits in the wild.

Successful exploitation of this vulnerability could allow an attacker to inject and execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to the number guess example within Apache Tomcat and does not indicate broader server compromise. No known exploits are reported at this time.

Users should upgrade affected Apache Tomcat versions to 11.0.23, 10.1.56, or 9.0.119, which contain fixes for this vulnerability. No other mitigation or temporary workaround is specified. Patch status is confirmed by the vendor advisory recommending these version upgrades.