logo

Database

Reflected cross-site scripting (XSS) In org.apache.struts:struts2-parent

Description

Apache Struts Multiple XSS Vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in

    FileHandler.java

    HiddenHandler.java

    PasswordHandler.java

    RadioHandler.java

    ResetHandler.java

    SelectHandler.java

    SubmitHandler.java

    TextFieldHandler.java

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2011-20872. NVD-2011-20873. OSV-2011-20874. GCVE-2011-2087

References

1. https://github.com/apache/struts/commit/1736b56db702c6639a6d5ae1146dba5a262e33442. https://issues.apache.org/jira/browse/WW-35973. https://issues.apache.org/jira/browse/WW-36084. http://struts.apache.org/2.2.3/docs/version-notes-223.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.