GHSA-2c6q-rgvj-66rxMedium

Apache Tiles Vulnerable to XSS via EL Expression Injection

Published
May 2, 2022
Last Modified
January 23, 2024

🔗 CVE IDs covered (1)

CVE-2009-1275 →

📋 Description

Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags.

🎯 Affected products1

  • maven/org.apache.tiles:tiles-core:>= 2.1, < 2.1.2

🔗 References (3)