CVE-2005-3745 Apache Struts Cross-site scripting Vulnerability
MediumCVSS 4.3
EPSS 25.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache struts | = 1.2.7 | No fix listed |
| org.apache.struts/struts-core(Maven) | <= 1.2.7 | No fix listed |
References
- 17677 third-party-advisory
- 18341 third-party-advisory
- 197 third-party-advisory
- 1015257 vdb-entry
- www.hacktics.com exploit patch vendor-advisory
- 21021 vdb-entry
- RHSA-2006:0157 vendor-advisory
- RHSA-2006:0161 vendor-advisory
- 20051121 Security Advisory: Struts Error Message Cross Site Scripting mailing-list
- 15512 exploit patch vdb-entry
- ADV-2005-2525 vdb-entry
- [struts-issues] 20201207 [jira] [Created] (WW-5105) Tracking the fix commit of CVE-2005-3745 and CVE-2018-1327 mailing-list
- [struts-issues] 20201207 [jira] [Updated] (WW-5105) Tracking the fix commit of CVE-2005-3745 and CVE-2018-1327 mailing-list
- nvd.nist.gov third-party-advisory vendor-advisory
- lists.apache.org
- lists.apache.org
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- github.com