logo

Database

Reflected cross-site scripting (XSS) In org.apache.struts:struts2-core

Description

Apache Struts is vulnerable to Cross-site Scripting Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2013-63482. NVD-2013-63483. OSV-2013-63484. GCVE-2013-63485. SECURITY-TRACKER-CVE-2013-63486. UBUNTU-CVE-2013-63487. bugzilla.redhat.com

References

1. https://issues.apache.org/jira/browse/WW-42132. https://svn.apache.org/viewvc?view=revision&revision=15333543. http://packetstormsecurity.com/files/123805/Struts-2.3.15.3-Cross-Site-Scripting.html4. http://seclists.org/fulldisclosure/2013/Oct/244

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.