cve.bz

CVE-2009-1275

no score yetEPSS 2.8%

apache tiles: no CVSS score yet. EPSS 2.8% chance of exploitation in the next 30 days. Fixed in org.apache.tiles:tiles-core 2.1.2.

Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags.
EPSS
2.8% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-2c6q-rgvj-66rxMavenorg.apache.tiles:tiles-core>=2.1 <2.1.22.1.2

References

Check your stackJSON