PT-2009-3809 · Apache · Apache Tiles+1

Publicado 2009-04-09 · Atualizado 2022-05-02 · CVE-2009-1275

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Tiles versions 2.1 through 2.1.1 Apache Struts (affected versions not specified)

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors. This is related to the tiles:putAttribute and tiles:insertTemplate JSP tags, which evaluate Expression Language (EL) expressions twice in certain circumstances.

Recommendations For Apache Tiles versions 2.1 through 2.1.1, update to version 2.1.2 or later. As a temporary workaround, consider restricting the use of the tiles:putAttribute and tiles:insertTemplate JSP tags until a patch is available.

Correção

Enumeração de Fraquezas

CWE-87

CWE-917

Identificadores relacionados

CVE-2009-1275

GHSA-2C6Q-RGVJ-66RX

Produtos afetados

Apache Struts

Apache Tiles

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2009-1275 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-2c6q-rgvj-66rx · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2009-1275 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1275 · Aviso do Fabricante
• http://svn.apache.org/viewvc/tiles/framework/trunk/src/site/apt/security/security-bulletin-1.apt?revision=741913 · Aviso do Fabricante
• http://securityfocus.com/bid/34657 · Nota
• https://security-tracker.debian.org/tracker/CVE-2009-1275 · Aviso do Fabricante
• https://issues.apache.org/struts/browse/TILES-351 · Aviso do Fabricante