Login Request a demo
Unscored severity · published Nov 22, 2005
CVE-2005-3745
Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string,…
–
CVSS
25.7%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
Exploitation
Is it being used?
Exploit prediction (EPSS)25.7% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Struts · Apache
1.2.7 · source: NVD
Affected product
ST
Struts
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-3745
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-3745
secunia.com
http://secunia.com/advisories/17677
secunia.com
http://secunia.com/advisories/18341
securityreason.com
http://securityreason.com/securityalert/197
securitytracker.com
http://securitytracker.com/id?1015257
Exploit
http://www.hacktics.com/AdvStrutsNov05.html
www.osvdb.org
http://www.osvdb.org/21021
More from Struts
9.8
CVE-2020-17530
Apache Struts Remote Code Execution Vulnerability
9.8
CVE-2017-9791
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage
9.8
CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload…
9.8
CVE-2013-2251
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction:…
9.8
CVE-2012-0391
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of…