Apache Struts Multiple XSS Vulnerabilities

2022-05-1705:41:08

Google

osv.dev

5.9 Medium

AI Score

Confidence

High

0.084 Low

EPSS

Percentile

94.4%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in

FileHandler.java
HiddenHandler.java
PasswordHandler.java
RadioHandler.java
ResetHandler.java
SelectHandler.java
SubmitHandler.java
TextFieldHandler.java

CPENameOperatorVersion
org.apache.struts:struts2-parenteq2.0.5
org.apache.struts:struts2-parenteq2.2.1
org.apache.struts:struts2-parenteq2.1.8.1
org.apache.struts:struts2-parenteq2.0.14
org.apache.struts:struts2-parenteq2.0.11
org.apache.struts:struts2-parenteq2.1.6
org.apache.struts:struts2-parenteq2.1.8
org.apache.struts:struts2-parenteq2.2.1.1
org.apache.struts:struts2-parenteq2.0.11.1
org.apache.struts:struts2-parenteq2.0.8

Name	Operator	Version
org.apache.struts:struts2-parent	eq	2.0.5
org.apache.struts:struts2-parent	eq	2.2.1
org.apache.struts:struts2-parent	eq	2.1.8.1
org.apache.struts:struts2-parent	eq	2.0.14
org.apache.struts:struts2-parent	eq	2.0.11
org.apache.struts:struts2-parent	eq	2.1.6
org.apache.struts:struts2-parent	eq	2.1.8
org.apache.struts:struts2-parent	eq	2.2.1.1
org.apache.struts:struts2-parent	eq	2.0.11.1
org.apache.struts:struts2-parent	eq	2.0.8