PT-2011-3360 · Apache+1 · Xwork+2
Marian Ventuneac
·
Published
2011-05-13
·
Updated
2022-05-17
·
CVE-2011-1772
CVSS v2.0
2.6
Low
| Vector | AV:N/AC:H/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Struts versions prior to 2.2.3
OpenSymphony WebWork (affected versions not specified)
Description
The issue allows remote attackers to inject arbitrary web script or HTML via various vectors, including an action name, the action attribute of an s:submit element, or the method attribute of an s:submit element. This is possible due to the lack of escaping for action names in automatically generated error pages in XWork. When Dynamic Method Invocation (DMI) is enabled, the action name can be generated dynamically based on request parameters, allowing for a successful attack by calling non-existing pages and methods to produce error pages with injected code.
Recommendations
For Apache Struts versions prior to 2.2.3, update to version 2.2.3 or later to resolve the issue.
For OpenSymphony WebWork, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Struts
Opensymphony Webwork
Xwork