CVE-2015-5169: XSS
Published Sep 4, 2015
·Updated
Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
Other sources
When debug mode is switched on in Apache Struts, under certain conditions an arbitrary script may be executed in the 'Problem Report' screen. Affected versions are Struts 2.0.0 - 2.3.16.3.
External reference:
https://struts.apache.org/docs/s2-025.html
— Red Hat
Affected Software
2 affected componentsFixes available
redhat/struts<2.3.20
2.3.20
Apache struts>=2.0.0<=2.3.16.3
Event History
Sep 25, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-5169?
CVE-2015-5169 is classified as a medium severity cross-site scripting vulnerability.
2
How do I fix CVE-2015-5169?
To fix CVE-2015-5169, upgrade Apache Struts to version 2.3.20 or later.
3
What versions are affected by CVE-2015-5169?
CVE-2015-5169 affects Apache Struts versions 2.0.0 to 2.3.16.3.
4
What impact does CVE-2015-5169 have?
CVE-2015-5169 allows an attacker to execute arbitrary scripts in the 'Problem Report' screen if debug mode is enabled.
5
Is CVE-2015-5169 still a risk in current Apache Struts versions?
No, CVE-2015-5169 is not a risk in Apache Struts versions 2.3.20 and later.