CVE-2011-1772 Cross-site Scripting in Apache Struts
LowCVSS 2.6
EPSS 33.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.struts/struts2-core(Maven) | < 2.2.3 | 2.2.3 |
| org.apache.struts/struts2-core(Maven) | = 2.0.11 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.11.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.11.2 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.12 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.14 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.5 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.6 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.8 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.9 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.1.2 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.1.6 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.1.8 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.1.8.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.2.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.2.1.1 | No fix listed |
| apache struts | = 2.0.0 | No fix listed |
| apache struts | = 2.0.1 | No fix listed |
| apache struts | = 2.0.2 | No fix listed |
| apache struts | = 2.0.3 | No fix listed |
| apache struts | = 2.0.4 | No fix listed |
| apache struts | = 2.0.5 | No fix listed |
| apache struts | = 2.0.6 | No fix listed |
| apache struts | = 2.0.7 | No fix listed |
| apache struts | = 2.0.8 | No fix listed |
Show 21 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache struts | = 2.0.9 | No fix listed |
| apache struts | = 2.0.10 | No fix listed |
| apache struts | = 2.0.11 | No fix listed |
| apache struts | = 2.0.11.1 | No fix listed |
| apache struts | = 2.0.11.2 | No fix listed |
| apache struts | = 2.0.12 | No fix listed |
| apache struts | = 2.0.13 | No fix listed |
| apache struts | = 2.0.14 | No fix listed |
| apache struts | = 2.1.0 | No fix listed |
| apache struts | = 2.1.1 | No fix listed |
| apache struts | = 2.1.2 | No fix listed |
| apache struts | = 2.1.3 | No fix listed |
| apache struts | = 2.1.4 | No fix listed |
| apache struts | = 2.1.5 | No fix listed |
| apache struts | = 2.1.6 | No fix listed |
| apache struts | = 2.1.8 | No fix listed |
| apache struts | = 2.1.8.1 | No fix listed |
| apache struts | = 2.2.1 | No fix listed |
| apache struts | = 2.2.1.1 | No fix listed |
| opensymphony webwork | All versions | No fix listed |
| opensymphony/xwork | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- issues.apache.org patch
- JVN#25435092 third-party-advisory
- JVNDB-2011-000106 third-party-advisory
- secureappdev.blogspot.com exploit
- struts.apache.org
- struts.apache.org exploit patch
- github.com
- github.com product
- secureappdev.blogspot.com
- 47784 exploit vdb-entry
- www.ventuneac.net exploit
- ADV-2011-1198 vdb-entry vendor-advisory