alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL DELETED Tomcat servlet mapping cross site scripting attempt"; flow:established,to_server; content:"/servlet/"; http_uri; content:"/org.apache."; http_uri; reference:bugtraq,5193; reference:cve,2002-0682; reference:nessus,11041; classtype:web-application-attack; sid:2101827; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_09_23, deployment Datacenter, signature_severity Major, tag XSS, tag Cross_Site_Scripting, updated_at 2019_07_26;)