GitHub Advisoryadvisory · Maven

GHSA-5pgj-r7c6-7c7w Apache Struts Multiple XSS Vulnerabilities

MEDIUM Published 2022-05-17 Modified 2024-01-19 Official page ↗
Aliases
CVE-2011-2087
Ecosystem
Maven
Packages
org.apache.struts:struts2-parent
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2024-01-19

Affected packages

• Maven org.apache.struts:struts2-parent: < 2.2.3 → fixed in 2.2.3

Description

Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a `.action` URI, related to improper handling of value attributes in 1. `FileHandler.java` 1. `HiddenHandler.java` 1. `PasswordHandler.java` 1. `RadioHandler.java` 1. `ResetHandler.java` 1. `SelectHandler.java` 1. `SubmitHandler.java` 1. `TextFieldHandler.java`

Related

Alias · CVE (1)

  • CVE-2011-2087 Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References