Unscored severity · published May 13, 2011
CVE-2011-1772
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject…
–
CVSS
33.3%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
Exploitation
Is it being used?
Exploit prediction (EPSS)33.3% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Struts · Apache
2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +22 more · source: NVD
WE
Webwork · Opensymphony
All versions, or not specified · source: NVD
XW
Xwork · Opensymphony
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1772
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1772
jvn.jp
http://jvn.jp/en/jp/JVN25435092/index.html
jvndb.jvn.jp
http://jvndb.jvn.jp/jvndb/JVNDB-2011-000106
secureappdev.blogspot.com
http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html
Exploit
http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html
struts.apache.org
http://struts.apache.org/2.2.3/docs/version-notes-223.html
Exploit
http://struts.apache.org/2.x/docs/s2-006.html
More from Struts
9.8
CVE-2020-17530
Apache Struts Remote Code Execution Vulnerability
9.8
CVE-2017-9791
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage
9.8
CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload…
9.8
CVE-2013-2251
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction:…
9.8
CVE-2012-0391
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of…