CVEvulnerability
CVE-2007-6726
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-04-09
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/.
Affected configurations
• apache struts 2.0.9
• dojotoolkit dojo 0.4.1
• dojotoolkit dojo 0.4.2
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://www.dojotoolkit.org/0-4-3-and-updated-0-4-1-0-4-2-builds Patch, Vendor Advisory
- http://www.dojotoolkit.org/2007/05/26/0-4-3-released-0-4-2-and-0-4-1-users-should-upgrade-immediately Patch, Vendor Advisory
- http://www.dojotoolkit.org/releaseNotes/0.4.3 Patch, Vendor Advisory
- http://www.securityfocus.com/bid/34660 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49884 exchange.xforce.ibmcloud.com
- https://issues.apache.org/struts/browse/WW-2134 Vendor Advisory
- http://www.dojotoolkit.org/0-4-3-and-updated-0-4-1-0-4-2-builds Patch, Vendor Advisory
- http://www.dojotoolkit.org/2007/05/26/0-4-3-released-0-4-2-and-0-4-1-users-should-upgrade-immediately Patch, Vendor Advisory
- http://www.dojotoolkit.org/releaseNotes/0.4.3 Patch, Vendor Advisory
- http://www.securityfocus.com/bid/34660 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49884 exchange.xforce.ibmcloud.com
- https://issues.apache.org/struts/browse/WW-2134 Vendor Advisory