CVEvulnerability
CVE-2008-6682
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-04-09
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.
Affected configurations
• apache struts 2.0.6
• apache struts 2.0.8
• apache struts 2.0.9
• apache struts 2.0.11
• apache struts 2.1
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449.html Patch
- http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449i20.html Patch
- http://www.securityfocus.com/bid/34686 www.securityfocus.com
- https://issues.apache.org/struts/browse/WW-2414 Vendor Advisory
- https://issues.apache.org/struts/browse/WW-2427 Vendor Advisory
- http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449.html Patch
- http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449i20.html Patch
- http://www.securityfocus.com/bid/34686 www.securityfocus.com
- https://issues.apache.org/struts/browse/WW-2414 Vendor Advisory
- https://issues.apache.org/struts/browse/WW-2427 Vendor Advisory