CVE-2011-1772: XSS
First published: Fri May 13 2011(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Struts | =2.0.9 | |
| Apache Struts | =2.0.12 | |
| Apache Struts | =2.1.0 | |
| Apache Struts | =2.0.0 | |
| Apache Struts | =2.0.8 | |
| Apache Struts | =2.0.7 | |
| Apache Struts | =2.0.4 | |
| Apache Struts | =2.2.1 | |
| Apache Struts | =2.1.8.1 | |
| Apache Struts | =2.1.3 | |
| Apache Struts | =2.1.2 | |
| Apache Struts | =2.1.5 | |
| Apache Struts | =2.0.1 | |
| Apache Struts | =2.0.2 | |
| Apache Struts | =2.1.8 | |
| Apache Struts | =2.0.11.1 | |
| Apache Struts | =2.0.3 | |
| Apache Struts | =2.0.14 | |
| Apache Struts | =2.0.11 | |
| Apache Struts | =2.1.6 | |
| Apache Struts | =2.0.5 | |
| Apache Struts | =2.1.4 | |
| Apache Struts | =2.2.1.1 | |
| Apache Struts | =2.0.11.2 | |
| Apache Struts | =2.0.13 | |
| Apache Struts | =2.1.1 | |
| Apache Struts | =2.0.6 | |
| Apache Struts | =2.0.10 | |
| OpenSymphony XWork | ||
| OpenSymphony WebWork |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://issues.apache.org/jira/browse/WW-3579
- http://struts.apache.org/2.x/docs/s2-006.html
- http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html
- http://struts.apache.org/2.2.3/docs/version-notes-223.html
- http://www.vupen.com/english/advisories/2011/1198
- http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html
- http://www.ventuneac.net/security-advisories/MVSA-11-006
- http://www.securityfocus.com/bid/47784
- http://jvn.jp/en/jp/JVN25435092/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2011-000106
- collector/nvd-historical
- collector/nvd-index
- agent/softwarecombine
- agent/remedy
- agent/type
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/apache
- canonical/apache struts
- version/apache struts/2.0.9
- version/apache struts/2.0.12
- version/apache struts/2.1.0
- version/apache struts/2.0.0
- version/apache struts/2.0.8
- version/apache struts/2.0.7
- version/apache struts/2.0.4
- version/apache struts/2.2.1
- version/apache struts/2.1.8.1
- version/apache struts/2.1.3
- version/apache struts/2.1.2
- version/apache struts/2.1.5
- version/apache struts/2.0.1
- version/apache struts/2.0.2
- version/apache struts/2.1.8
- version/apache struts/2.0.11.1
- version/apache struts/2.0.3
- version/apache struts/2.0.14
- version/apache struts/2.0.11
- version/apache struts/2.1.6
- version/apache struts/2.0.5
- version/apache struts/2.1.4
- version/apache struts/2.2.1.1
- version/apache struts/2.0.11.2
- version/apache struts/2.0.13
- version/apache struts/2.1.1
- version/apache struts/2.0.6
- version/apache struts/2.0.10
- vendor/opensymphony
- canonical/opensymphony xwork
- canonical/opensymphony webwork