CVE-2013-6348: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/.
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.struts:struts2-coreto a version that resolves this vulnerability.Fixed in 2.3.16 - Upgrade
Upgrade
Apache Strutsto a version that resolves this vulnerability.Fixed in 2.3.15.3 - Configuration
Update Apache Struts so that the namespace parameter used by actionNames.action and showConfig.action in config-browser/ is properly validated/sanitized to prevent arbitrary web script or HTML injection (XSS).
Apache Struts config-browser/ (actionNames.action and showConfig.action) namespace parameter input/output handling = Sanitize/validate the namespace parameter to prevent injection into the web response
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6348?
CVE-2013-6348 is classified as a high severity vulnerability due to the potential for remote code execution through cross-site scripting attacks.
How do I fix CVE-2013-6348?
To fix CVE-2013-6348, upgrade to Apache Struts version 2.3.16 or later where the vulnerability has been addressed.
What are the consequences of exploiting CVE-2013-6348?
Exploiting CVE-2013-6348 can allow attackers to execute arbitrary scripts in the context of a user's browser, impacting user data integrity and confidentiality.
Which versions of Apache Struts are affected by CVE-2013-6348?
CVE-2013-6348 affects Apache Struts version 2.3.15.3 specifically.
Is CVE-2013-6348 a client-side or server-side vulnerability?
CVE-2013-6348 is primarily a server-side vulnerability that facilitates client-side exploitation through injected scripts.