CVE-2012-1006: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders.
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders.
Affected Software
Event History
Frequently Asked Questions
What are the main vulnerabilities associated with CVE-2012-1006?
CVE-2012-1006 is associated with multiple cross-site scripting (XSS) vulnerabilities in Apache Struts allowing injection via specific parameters.
What versions of Apache Struts are affected by CVE-2012-1006?
CVE-2012-1006 affects Apache Struts versions 2.0.14 and 2.2.3.
How can I mitigate the risks of CVE-2012-1006?
To mitigate CVE-2012-1006, users should upgrade to a patched version of Apache Struts that addresses these XSS vulnerabilities.
Is CVE-2012-1006 a critical vulnerability?
CVE-2012-1006 is considered a significant security risk due to its potential for remote attackers to inject malicious scripts.
What types of attacks are possible through CVE-2012-1006?
CVE-2012-1006 allows remote attackers to perform cross-site scripting attacks, potentially compromising user sessions and data.