GitHub Advisoryadvisory · Maven

GHSA-2c6q-rgvj-66rx Apache Tiles Vulnerable to XSS via EL Expression Injection

MEDIUM Published 2022-05-02 Modified 2024-01-23 Official page ↗
Aliases
CVE-2009-1275
Ecosystem
Maven
Packages
org.apache.tiles:tiles-core
Severity
Moderate
Weaknesses
CWE-87, CWE-917
Reviewed
2024-01-23

Affected packages

• Maven org.apache.tiles:tiles-core: >= 2.1, < 2.1.2 → fixed in 2.1.2

Description

Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) `tiles:putAttribute` and (2) `tiles:insertTemplate` JSP tags.

Related

Alias · CVE (1)

  • CVE-2009-1275 Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain… vulnerability

Weakness · CWE (2)

  • CWE-87 Improper Neutralization of Alternate XSS Syntax weakness
  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement weakness

References