Published: 13/05/2011 Updated: 19/01/2012
CVSS v2 Base Score: 2.6 | Impact Score: 2.9 | Exploitability Score: 4.9
VMScore: 266
Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N

Vulnerability Summary

Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x prior to 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote malicious users to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.

Most Upvoted Vulmon Research Post

There is no Researcher post for this vulnerability
Would you like to share something about it? Sign up now to share your knowledge with the community.
Vulnerable Product Search on Vulmon Subscribe to Product

apache struts 2.0.8

apache struts 2.0.6

apache struts 2.0.13

apache struts 2.0.12

apache struts 2.0.10

apache struts 2.0.0

apache struts

apache struts

apache struts 2.1.2

apache struts 2.0.14

apache struts 2.0.4

apache struts 2.0.7

apache struts

apache struts 2.0.11

apache struts 2.0.9

apache struts 2.2.1

apache struts 2.1.3

apache struts 2.1.0

apache struts 2.1.8

apache struts

apache struts 2.0.2

apache struts 2.0.5

apache struts 2.1.5

apache struts 2.1.4

apache struts 2.1.6

apache struts 2.1.1

apache struts 2.0.1

apache struts 2.0.3

opensymphony xwork

opensymphony webwork


source: wwwsecurityfocuscom/bid/47784/info Apache Struts is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data Successful exploitation requires 'Dynamic Method Invocation' to be enabled by default An attacker may leverage this issue to execute arbitrary script code in the browser ...

Mailing Lists

Apache Struts 2 framework before version 223 is vulnerable to reflected cross site scripting attacks when default XWork generated error messages are displayed ...

Github Repositories

What this is generate_esgfconfsh is a script file from the esgf_scanner repo which is used to generate as output, a configuration file for use with the CVEChecker tool The idea is to be able to auto-generate a manifest for each release, and use that an input to scan for known vulnerabilities When a reported vulnerability is studied and deemed to be addressed, it can then be

What is CVEChecker ? CVEChecker is a tool that aggregates CVE information from Redhat and the NVD vulnerability data feeds, to setup a local vulnerability store that can be queried offline Vulnerabilities can be looked up on the basis of user-specified parameters such as a product name, keywords in the vulnerability description, or the CVEid itself Filters such as --aft