logo

Database

Lack of data validation - Path Traversal In org.apache.struts:struts-core

Description

Apache Struts Cross-site scripting Vulnerability Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version

Aliases

1. CVE-2005-37452. NVD-2005-37453. OSV-2005-37454. GCVE-2005-3745

References

1. https://lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3@%3Cissues.struts.apache.org%3E2. https://lists.apache.org/thread.html/rf482c101a88445d73cc2e89dbf7f16ae00a4aa79a544a1e72b2326db@%3Cissues.struts.apache.org%3E3. https://web.archive.org/web/20051230061138/http://www.hacktics.com/AdvStrutsNov05.html4. https://web.archive.org/web/20060315133810/http://securitytracker.com/alerts/2005/Nov/1015257.html5. https://web.archive.org/web/20060408105414/http://www.securityfocus.com/bid/155126. https://web.archive.org/web/20201125023452/http://www.securityfocus.com/archive/1/417296/30/0/threaded7. https://web.archive.org/web/20201207010315/https://cxsecurity.com/issue/WLB-20051100558. http://www.redhat.com/support/errata/RHSA-2006-0157.html9. http://www.redhat.com/support/errata/RHSA-2006-0161.html10. https://www.exploit-db.com/exploits/26542

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.