CVE-2011-1772
En bref
- Source
- NVD
- EPSS
- EPSS 33.35 % · centile 98 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
Faiblesses (CWE)
- CWE-79 — Injection de code indirecte (XSS)
Références
- http://www.vupen.com/english/advisories/2011/1198
- http://www.securityfocus.com/bid/47784
- http://struts.apache.org/2.x/docs/s2-006.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2011-000106
- http://jvn.jp/en/jp/JVN25435092/index.html
- http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html
- http://struts.apache.org/2.2.3/docs/version-notes-223.html
- http://www.ventuneac.net/security-advisories/MVSA-11-006
- https://issues.apache.org/jira/browse/WW-3579
- http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | LOW 2.6 | AV:N/AC:H/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-56f8-g68r-j699 — Cross-site Scripting in Apache Struts
Références européennes
- ENISA EUVD · EUVD-2022-2509
- GCVE · GCVE-0-2011-1772
Configurations affectées (CPE NVD)
cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*cpe:2.3:a:opensymphony:webwork:*:*:*:*:*:*:*:*cpe:2.3:a:opensymphony:xwork:*:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |