CVE-2011-2087 Apache Struts Multiple XSS Vulnerabilities
MediumCVSS 4.3
EPSS 6.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.struts/struts2-parent(Maven) | < 2.2.3 | 2.2.3 |
| org.apache.struts/struts2-parent(Maven) | = 2.0.11 | No fix listed |
| org.apache.struts/struts2-parent(Maven) | = 2.0.11.1 | No fix listed |
| org.apache.struts/struts2-parent(Maven) | = 2.0.11.2 | No fix listed |
| org.apache.struts/struts2-parent(Maven) | = 2.0.12 | No fix listed |
| org.apache.struts/struts2-parent(Maven) | = 2.0.14 | No fix listed |
| org.apache.struts/struts2-parent(Maven) | = 2.0.5 | No fix listed |
| org.apache.struts/struts2-parent(Maven) | = 2.0.6 | No fix listed |
| org.apache.struts/struts2-parent(Maven) | = 2.0.8 | No fix listed |
| org.apache.struts/struts2-parent(Maven) | = 2.0.9 | No fix listed |
| org.apache.struts/struts2-parent(Maven) | = 2.1.2 | No fix listed |
| org.apache.struts/struts2-parent(Maven) | = 2.1.6 | No fix listed |
| org.apache.struts/struts2-parent(Maven) | = 2.1.8 | No fix listed |
| org.apache.struts/struts2-parent(Maven) | = 2.1.8.1 | No fix listed |
| org.apache.struts/struts2-parent(Maven) | = 2.2.1 | No fix listed |
| org.apache.struts/struts2-parent(Maven) | = 2.2.1.1 | No fix listed |
| apache struts | = 2.0.0 | No fix listed |
| apache struts | = 2.0.1 | No fix listed |
| apache struts | = 2.0.2 | No fix listed |
| apache struts | = 2.0.3 | No fix listed |
| apache struts | = 2.0.4 | No fix listed |
| apache struts | = 2.0.5 | No fix listed |
| apache struts | = 2.0.6 | No fix listed |
| apache struts | = 2.0.7 | No fix listed |
| apache struts | = 2.0.8 | No fix listed |
Show 19 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache struts | = 2.0.9 | No fix listed |
| apache struts | = 2.0.10 | No fix listed |
| apache struts | = 2.0.11 | No fix listed |
| apache struts | = 2.0.11.1 | No fix listed |
| apache struts | = 2.0.11.2 | No fix listed |
| apache struts | = 2.0.12 | No fix listed |
| apache struts | = 2.0.13 | No fix listed |
| apache struts | = 2.0.14 | No fix listed |
| apache struts | = 2.1.0 | No fix listed |
| apache struts | = 2.1.1 | No fix listed |
| apache struts | = 2.1.2 | No fix listed |
| apache struts | = 2.1.3 | No fix listed |
| apache struts | = 2.1.4 | No fix listed |
| apache struts | = 2.1.5 | No fix listed |
| apache struts | = 2.1.6 | No fix listed |
| apache struts | = 2.1.8 | No fix listed |
| apache struts | = 2.1.8.1 | No fix listed |
| apache struts | = 2.2.1 | No fix listed |
| apache struts | = 2.2.1.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com product
- issues.apache.org exploit
- issues.apache.org
- struts.apache.org
- github.com
- ADV-2011-1198 vdb-entry vendor-advisory