Description
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
Remediation
References
http://jvn.jp/en/jp/JVN25435092/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2011-000106
http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html
http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html
http://struts.apache.org/2.2.3/docs/version-notes-223.html
http://struts.apache.org/2.x/docs/s2-006.html
http://www.securityfocus.com/bid/47784
http://www.ventuneac.net/security-advisories/MVSA-11-006
http://www.vupen.com/english/advisories/2011/1198
https://issues.apache.org/jira/browse/WW-3579
Related Vulnerabilities
CVE-2017-16016 Vulnerability in npm package sanitize-html
CVE-2019-5447 Vulnerability in npm package http-file-server
CVE-2016-10707 Vulnerability in maven package org.webjars.npm:jquery
CVE-2023-39532 Vulnerability in npm package ses
CVE-2023-40812 Vulnerability in maven package org.opencrx:opencrx-core-models