PT-2009-3809 · Apache · Apache Tiles+1

Published 2009-04-09 · Updated 2022-05-02 · CVE-2009-1275

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Tiles versions 2.1 through 2.1.1 Apache Struts (affected versions not specified)

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors. This is related to the tiles:putAttribute and tiles:insertTemplate JSP tags, which evaluate Expression Language (EL) expressions twice in certain circumstances.

Recommendations For Apache Tiles versions 2.1 through 2.1.1, update to version 2.1.2 or later. As a temporary workaround, consider restricting the use of the tiles:putAttribute and tiles:insertTemplate JSP tags until a patch is available.

Fix

Weakness Enumeration

CWE-87

CWE-917

Related Identifiers

CVE-2009-1275

GHSA-2C6Q-RGVJ-66RX

Affected Products

Apache Struts

Apache Tiles

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2009-1275 · Security Note
• https://osv.dev/vulnerability/GHSA-2c6q-rgvj-66rx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-1275 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1275 · Vendor Advisory
• http://svn.apache.org/viewvc/tiles/framework/trunk/src/site/apt/security/security-bulletin-1.apt?revision=741913 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-1275 · Vendor Advisory
• https://issues.apache.org/struts/browse/TILES-351 · Vendor Advisory
• http://securityfocus.com/bid/34657 · Note