CVE-2008-6682: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6682?
CVE-2008-6682 has a medium severity rating due to the presence of multiple cross-site scripting vulnerabilities.
How do I fix CVE-2008-6682?
To mitigate CVE-2008-6682, upgrade Apache Struts to version 2.0.11.1 or 2.1.1 or higher.
What versions of Apache Struts are affected by CVE-2008-6682?
CVE-2008-6682 affects Apache Struts versions 2.0.6, 2.0.8, 2.0.9, and all 2.1.x versions prior to 2.1.1.
What types of attacks can occur due to CVE-2008-6682?
CVE-2008-6682 allows remote attackers to perform cross-site scripting attacks through the improper handling of HTML and script injection.
Is there a public exploit available for CVE-2008-6682?
While specific exploits for CVE-2008-6682 may exist, they are typically not publicly disclosed to prevent abuse.