Apache Struts Multiple XSS Vulnerabilities

CVE-2011-2087 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in
1. FileHandler.java
1. HiddenHandler.java
1. PasswordHandler.java
1. RadioHandler.java
1. ResetHandler.java
1. SelectHandler.java
1. SubmitHandler.java
1. TextFieldHandler.java

Basic information

Type
reviewed
Severity
medium
Advisory on GitHub
Open advisory ↗
Repository advisory
—
Source code
Browse source ↗
Published (advisory)
2022-05-17 05:41:08 UTC
Updated
2024-01-19 18:23:14 UTC
GitHub reviewed
2024-01-19 18:23:12 UTC
NVD published
2011-05-13

EPSS Score

Score Percentile
1.39% 79.79%

CVSS Scores

No CVSS scores in this advisory.

Identifiers

Type Value
GHSA GHSA-5pgj-r7c6-7c7w ↗
CVE CVE-2011-2087 ↗

CWEs

CWE id Name
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
maven org.apache.struts:struts2-parent < 2.2.3 2.2.3 —

References

cvelogic Threat Intelligence