CVE-2008-6682
apache struts: no CVSS score yet. EPSS 5.6% chance of exploitation in the next 30 days. Fixed in org.apache.struts:struts2-core 2.0.11.1, 2.1.1.
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.
- EPSS
- 5.6% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:struts
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jgcr-9c2q-rvp8 | Maven | org.apache.struts:struts2-core | >=2.0.0 <2.0.11.1 | 2.0.11.1 |
| GHSA-jgcr-9c2q-rvp8 | Maven | org.apache.struts:struts2-core | >=2.1.0 <2.1.1 | 2.1.1 |
References
- http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449.html
- http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449i20.html
- http://www.securityfocus.com/bid/34686
- https://issues.apache.org/struts/browse/WW-2414
- https://issues.apache.org/struts/browse/WW-2427