Description

Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.

Remediation

References

https://issues.apache.org/jira/browse/WW-3579

http://struts.apache.org/2.x/docs/s2-006.html

http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html

http://struts.apache.org/2.2.3/docs/version-notes-223.html

http://www.vupen.com/english/advisories/2011/1198

http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html

http://www.ventuneac.net/security-advisories/MVSA-11-006

http://www.securityfocus.com/bid/47784

http://jvn.jp/en/jp/JVN25435092/index.html

http://jvndb.jvn.jp/jvndb/JVNDB-2011-000106

Related Vulnerabilities

CVE-2014-7810 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2023-46119 Vulnerability in npm package parse-server

CVE-2022-34115 Vulnerability in maven package io.dataease:dataease-plugin-common

CVE-2017-18924 Vulnerability in npm package oauth2-server

CVE-2020-5251 Vulnerability in npm package parse-server

Severity

Critical

Classification

CWE-79

Tags

Patch Exploit Vendor Advisory