GHSA-3g8j-jj54-3vjgMedium

Apache Struts is vulnerable to Cross-site Scripting

Published
May 17, 2022
Last Modified
August 15, 2023

🔗 CVE IDs covered (1)

CVE-2013-6348 →

📋 Description

Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/.

🎯 Affected products1

  • maven/org.apache.struts:struts2-core:< 2.3.16

🔗 References (8)