PT-2009-1188 · Suse+1 · Opensuse+2

Published 2009-04-09 · Updated 2022-05-01 · CVE-2008-2025

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Struts versions prior to 1.2.9-162.31.1 on SUSE Linux Enterprise 11 Apache Struts versions prior to 1.2.9-108.2 on SUSE openSUSE 10.3 Apache Struts versions prior to 1.2.9-198.2 on SUSE openSUSE 11.0 Apache Struts versions prior to 1.2.9-162.163.2 on SUSE openSUSE 11.1

Description The issue is related to a cross-site scripting (XSS) vulnerability due to insufficient quoting of parameters, allowing remote attackers to inject arbitrary web script or HTML.

Recommendations For Apache Struts on SUSE Linux Enterprise 11, update to version 1.2.9-162.31.1 or later. For Apache Struts on SUSE openSUSE 10.3, update to version 1.2.9-108.2 or later. For Apache Struts on SUSE openSUSE 11.0, update to version 1.2.9-198.2 or later. For Apache Struts on SUSE openSUSE 11.1, update to version 1.2.9-162.163.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-2025

GHSA-WCGX-2HVX-5CWR

Affected Products

Apache Struts

Suse Linux Enterprise

Opensuse

References · 13

• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html · Vendor Advisory
• http://download.opensuse.org/update/10.3-test/repodata/patch-struts-5872.xml · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-2025 · Security Note
• https://osv.dev/vulnerability/GHSA-wcgx-2hvx-5cwr · Vendor Advisory
• https://github.com/apache/struts · Note
• https://bugzilla.novell.com/show_bug.cgi?id=385273 · Note
• http://secunia.com/advisories/34642 · Note
• http://support.novell.com/security/cve/CVE-2008-2025.html · Note
• http://osvdb.org/53380 · Note
• https://web.archive.org/web/20090410082732/http://secunia.com/advisories/34642 · Note
• http://secunia.com/advisories/34567 · Note
• https://launchpad.net/bugs/cve/2008-2025 · Note
• https://web.archive.org/web/20090411051126/http://secunia.com/advisories/34567 · Note