GHSA-p3vw-fvwx-qcv5

Cross-site scripting in Apache Struts

Source: GitHub Advisory Database (reviewed) Low CVE-2006-1548

Packages

Ecosystem	Package	Affected	Fixed in
Maven	struts:struts	< 1.2.9	1.2.9

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2006-1548 advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/25614 web
https://github.com/apache/struts package