GitHub Advisoryadvisory · Maven

GHSA-56f8-g68r-j699 Cross-site Scripting in Apache Struts

LOW Published 2022-05-17 Modified 2022-11-03 Official page ↗
Aliases
CVE-2011-1772
Ecosystem
Maven
Packages
org.apache.struts:struts2-core
Severity
Low
Weaknesses
CWE-79
Reviewed
2022-11-03

Affected packages

• Maven org.apache.struts:struts2-core: < 2.2.3 → fixed in 2.2.3

Description

Multiple Cross-Site Scripting (XSS) in XWork generated error pages in Apache Struts. By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation (DMI) is enabled, the action name is generated dynamically base on request parameters. This allows to call non-existing page and method to produce error page with injected code as below. As of Struts 2.2.3 the action names are escaped when automatically generated error pages are rendered.

Related

Alias · CVE (1)

  • CVE-2011-1772 Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References