GHSA-56f8-g68r-j699

Source

https://github.com/advisories/GHSA-56f8-g68r-j699

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-56f8-g68r-j699/GHSA-56f8-g68r-j699.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-56f8-g68r-j699

Aliases

CVE-2011-1772

Published

2022-05-17T05:35:28Z

Modified

2024-12-04T05:41:11.148238Z

Summary

Cross-site Scripting in Apache Struts

Details

Multiple Cross-Site Scripting (XSS) in XWork generated error pages in Apache Struts. By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation (DMI) is enabled, the action name is generated dynamically base on request parameters. This allows to call non-existing page and method to produce error page with injected code as below. As of Struts 2.2.3 the action names are escaped when automatically generated error pages are rendered.

Database specific

{
    "github_reviewed": true,
    "severity": "LOW",
    "github_reviewed_at": "2022-11-03T23:10:43Z",
    "nvd_published_at": "2011-05-13T17:05:00Z",
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Maven / org.apache.struts:struts2-core

Package

Name: org.apache.struts:struts2-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.struts/struts2-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.3

Affected versions

2.*

2.0.5

2.0.6

2.0.8

2.0.9

2.0.11

2.0.11.1

2.0.11.2

2.0.12

2.0.14

2.1.2

2.1.6

2.1.8

2.1.8.1

2.2.1

2.2.1.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-56f8-g68r-j699/GHSA-56f8-g68r-j699.json"