PT-2009-1188 · Suse+1 · Opensuse+2

Publicado 2009-04-09 · Atualizado 2022-05-01 · CVE-2008-2025

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Struts versions prior to 1.2.9-162.31.1 on SUSE Linux Enterprise 11 Apache Struts versions prior to 1.2.9-108.2 on SUSE openSUSE 10.3 Apache Struts versions prior to 1.2.9-198.2 on SUSE openSUSE 11.0 Apache Struts versions prior to 1.2.9-162.163.2 on SUSE openSUSE 11.1

Description The issue is related to a cross-site scripting (XSS) vulnerability due to insufficient quoting of parameters, allowing remote attackers to inject arbitrary web script or HTML.

Recommendations For Apache Struts on SUSE Linux Enterprise 11, update to version 1.2.9-162.31.1 or later. For Apache Struts on SUSE openSUSE 10.3, update to version 1.2.9-108.2 or later. For Apache Struts on SUSE openSUSE 11.0, update to version 1.2.9-198.2 or later. For Apache Struts on SUSE openSUSE 11.1, update to version 1.2.9-162.163.2 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-2025

GHSA-WCGX-2HVX-5CWR

Produtos afetados

Apache Struts

Suse Linux Enterprise

Opensuse

Referências · 13

• https://github.com/apache/struts · Nota
• https://bugzilla.novell.com/show_bug.cgi?id=385273 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html · Aviso do Fabricante
• http://secunia.com/advisories/34642 · Nota
• http://support.novell.com/security/cve/CVE-2008-2025.html · Nota
• http://download.opensuse.org/update/10.3-test/repodata/patch-struts-5872.xml · Correção
• http://osvdb.org/53380 · Nota
• https://web.archive.org/web/20090410082732/http://secunia.com/advisories/34642 · Nota
• http://secunia.com/advisories/34567 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2025 · Nota de Segurança
• https://launchpad.net/bugs/cve/2008-2025 · Nota
• https://osv.dev/vulnerability/GHSA-wcgx-2hvx-5cwr · Aviso do Fabricante
• https://web.archive.org/web/20090411051126/http://secunia.com/advisories/34567 · Nota