PT-2009-2151 · Apache · Apache Struts

Publicado 2009-04-09 · Atualizado 2022-05-17 · CVE-2008-6682

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.x before 2.0.11.1 Apache Struts versions 2.1.x before 2.1.1

Description The issue is related to multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The improper handling of href attribute of an s:a tag, specifically with double quote characters, and parameters in the action attribute of an s:url tag are the causes of these vulnerabilities.

Recommendations For Apache Struts versions 2.0.x before 2.0.11.1, update to version 2.0.11.1 or later. For Apache Struts versions 2.1.x before 2.1.1, update to version 2.1.1 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-6682

GHSA-JGCR-9C2Q-RVP8

Produtos afetados

Apache Struts

Referências · 14

• https://github.com/apache/struts · Nota
• https://github.com/apache/struts/commit/09147ffad2b3046ed21af0f524c5088e2ac551e6 · Nota
• https://github.com/apache/struts/commit/dae026a0f0511f83852053bae9d5a622e7f80486 · Nota
• https://github.com/apache/struts/commit/bd3f2f59c9b09f70aed3ebab6bb69b464ee2d6cb · Nota
• https://web.archive.org/web/20080610075918/http://nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449i20.html · Nota
• http://nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449.html · Correção
• https://web.archive.org/web/20200229155553/http://securityfocus.com/bid/34686 · Nota
• http://securityfocus.com/bid/34686 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-6682 · Nota de Segurança
• https://issues.apache.org/struts/browse/WW-2427 · Aviso do Fabricante
• https://issues.apache.org/struts/browse/WW-2414 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-jgcr-9c2q-rvp8 · Aviso do Fabricante
• https://web.archive.org/web/20080611112834/http://nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449.html · Nota
• http://nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449i20.html · Correção