Most recent entries from all

bdu:2022-05825

cnvd-2015-06370

EUVD-2026-93259

fkie_cve-2015-5169

Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.

GHSA-vwhv-j36g-5rm8 — Cross-site Scripting in Apache Struts

Affected: Maven: org.apache.struts:struts2-core

When the Struts2 debug mode is turned on, under certain conditions an arbitrary script may be executed in the 'Problem Report' screen. Also if JSP files are exposed to be accessed directly it's possible to execute an arbitrary script.

It is generally not advisable to have debug mode switched on outside of the development environment. Debug mode should always be turned off in production setup. Also never expose JSPs files directly and hide them inside WEB-INF folder or define dedicated security constraints to block access to raw JSP files.

Struts >= 2.3.20 is not vulnerable to this attack. We recommend upgrading to Struts 2.3.20 or higher.

gsd-2015-5169

jvndb-2015-000125

Apache Struts provided by the Apache Software Foundation is a software framework for creating Java web applications. Apache Struts contains a cross-site scripting vulnerability when devMode is left turned on. Masaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.