GHSA-p3vw-fvwx-qcv5

ghsaUSosv

Cross-site scripting in Apache Struts

view advisory published 2022-05-01Licence: CC-BY-4.0

Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2006-1548US	medium4.3	5.45% (93rd)	—	2006-03-30
Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.…

references

External citations — patches, advisories, analysis.

https://exchange.xforce.ibmcloud.com/vulnerabilities/25614WEB
https://github.com/apache/strutsPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2006-1548ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan