The vulnerability is a basic Cross-Site Scripting (XSS) flaw in the number guess example application within Apache Tomcat. It arises from improper neutralization of script-related HTML tags, which could allow an attacker to inject malicious scripts into web pages. Affected versions span from 7.0.0 through 11.0.22 across multiple Tomcat branches. The issue is resolved in versions 11.0.23, 10.1.56, and 9.0.119. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, low confidentiality and integrity impact, and no availability impact.

Successful exploitation could allow an attacker to execute scripts in the context of the affected web application, potentially leading to partial confidentiality and integrity compromise. The vulnerability does not impact availability. The scope is changed, meaning the vulnerability affects resources beyond the security scope of the vulnerable component.

Users should upgrade affected Apache Tomcat versions to 11.0.23, 10.1.56, or 9.0.119, which contain fixes for this vulnerability. No other mitigation is indicated. Patch status is confirmed by the vendor's versioning information.