What is GHSA-cmpm-jg8r-fv37?

GHSA-cmpm-jg8r-fv37 is a security advisory published by GitHub Security Advisories with Medium severity. Apache Struts Multiple Cross-site Scripting Vulnerabilities

Which CVE IDs does GHSA-cmpm-jg8r-fv37 cover?

GHSA-cmpm-jg8r-fv37 covers the following CVE IDs: CVE-2012-1006. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-cmpm-jg8r-fv37?

GHSA-cmpm-jg8r-fv37 affects 2 products, including: maven/org.apache.struts:struts2-parent:\u003c= 2.0.14; maven/org.apache.struts:struts2-parent:\u003e= 2.2, \u003c= 2.2.3.

GHSA-cmpm-jg8r-fv37Medium

Apache Struts Multiple Cross-site Scripting Vulnerabilities

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

August 29, 2023

🔗 CVE IDs covered (1)

CVE-2012-1006 →

📋 Description

Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders.

🎯 Affected products2

maven/org.apache.struts:struts2-parent:<= 2.0.14
maven/org.apache.struts:struts2-parent:>= 2.2, <= 2.2.3

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2012-1006
https://exchange.xforce.ibmcloud.com/vulnerabilities/72888
https://web.archive.org/web/20120219225953/http://secpod.org/advisories/SecPod_Apache_Struts_Multiple_Parsistant_XSS_Vulns.txt
https://web.archive.org/web/20131013214245/http://secpod.org/blog/?p=450
https://web.archive.org/web/20200229131840/http://www.securityfocus.com/bid/51902
https://github.com/advisories/GHSA-cmpm-jg8r-fv37