CVE-2007-6726 Apache Struts Dojo Plugin XSS Vulnerability
MediumCVSS 4.3
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.struts/struts2-dojo-plugin(Maven) | >= 0.4.1, <= 0.4.2 | No fix listed |
| org.apache.struts/struts2-dojo-plugin(Maven) | >= 0.4.1, < 0.4.3 | 0.4.3 |
| apache struts | = 2.0.9 | No fix listed |
| dojotoolkit dojo | = 0.4.1 | No fix listed |
| dojotoolkit dojo | = 0.4.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- dojo-xipclient-xipserver-xss(49884) vdb-entry
- issues.apache.org vendor-advisory
- www.dojotoolkit.org patch vendor-advisory
- www.dojotoolkit.org patch vendor-advisory
- www.dojotoolkit.org patch vendor-advisory
- 34660 vdb-entry
- github.com
- github.com