~ / search / GHSA-2c6q-rgvj-66rx

GHSA-2c6q-rgvj-66rx

Apache Tiles Vulnerable to XSS via EL Expression Injection

Source: GitHub Advisory Database (reviewed) Moderate CVE-2009-1275

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.tiles:tiles-core >= 2.1, < 2.1.2 2.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) `tiles:putAttribute` and (2) `tiles:insertTemplate` JSP tags.

References

External links from the advisory. They lead to third-party sites.