GHSA-56f8-g68r-j699
Cross-site Scripting in Apache Struts
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2011-1772
Description
Multiple Cross-Site Scripting (XSS) in XWork generated error pages in Apache Struts. By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation (DMI) is enabled, the action name is generated dynamically base on request parameters. This allows to call non-existing page and method to produce error page with injected code as below. As of Struts 2.2.3 the action names are escaped when automatically generated error pages are rendered.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.apache.struts:struts2-core | introduced 0, fixed 2.2.3 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2011-1772 ADVISORY
- https://github.com/apache/struts PACKAGE
- https://issues.apache.org/jira/browse/WW-3579 WEB
- http://jvn.jp/en/jp/JVN25435092/index.html WEB
- http://jvndb.jvn.jp/jvndb/JVNDB-2011-000106 WEB
- http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html WEB
- http://struts.apache.org/2.2.3/docs/version-notes-223.html WEB
- http://struts.apache.org/2.x/docs/s2-006.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |