CVE-2011-2087

no score yetEPSS 6.1%

Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.

EPSS: 6.1% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2011-05-13
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

apache:struts

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-5pgj-r7c6-7c7w	Maven	org.apache.struts:struts2-parent	<2.2.3	2.2.3

References

http://struts.apache.org/2.2.3/docs/version-notes-223.html
http://www.vupen.com/english/advisories/2011/1198
https://issues.apache.org/jira/browse/WW-3597
https://issues.apache.org/jira/browse/WW-3608
http://struts.apache.org/2.2.3/docs/version-notes-223.html

Check your stack JSON