GitHub Advisoryadvisory · Maven

GHSA-rm26-w253-9qv7 Apache Struts Dojo Plugin XSS Vulnerability

MEDIUM Published 2022-05-01 Modified 2023-09-22 Official page ↗
Aliases
CVE-2007-6726
Ecosystem
Maven
Packages
org.apache.struts:struts2-dojo-plugin
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2023-09-22

Affected packages

• Maven org.apache.struts:struts2-dojo-plugin: >= 0.4.1, < 0.4.3 → fixed in 0.4.3

Description

Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) `xip_client.html` and (2) `xip_server.html` in `src/io/`.

Related

Alias · CVE (1)

  • CVE-2007-6726 Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References