logo

Database

Reflected cross-site scripting (XSS) In org.apache.struts:struts2-parent

Description

Apache Struts Multiple Cross-site Scripting Vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2012-10062. NVD-2012-10063. OSV-2012-10064. GCVE-2012-1006

References

1. https://exchange.xforce.ibmcloud.com/vulnerabilities/728882. https://web.archive.org/web/20120219225953/http://secpod.org/advisories/SecPod_Apache_Struts_Multiple_Parsistant_XSS_Vulns.txt3. https://web.archive.org/web/20131013214245/http://secpod.org/blog/?p=4504. https://web.archive.org/web/20200229131840/http://www.securityfocus.com/bid/51902

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.