Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/25614 | vdb-entry x_refsource_XF |
| http://securitytracker.com/id?1015856 | vdb-entry x_refsource_SECTRACK |
| http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html | x_refsource_CONFIRM |
| http://www.vupen.com/english/advisories/2006/1205 | vdb-entry x_refsource_VUPEN |
| http://www.securityfocus.com/bid/17342 | vdb-entry x_refsource_BID |
| http://secunia.com/advisories/19493 | third-party-advisory x_refsource_SECUNIA |
| https://issues.apache.org/struts/browse/STR-2781 | x_refsource_CONFIRM |
| http://issues.apache.org/bugzilla/show_bug.cgi?id=38749 | x_refsource_CONFIRM |
| http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html | vendor-advisory x_refsource_SUSE |
| http://secunia.com/advisories/20117 | third-party-advisory x_refsource_SECUNIA |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/25614 | vdb-entry x_refsource_XF x_transferred |
| http://securitytracker.com/id?1015856 | vdb-entry x_refsource_SECTRACK x_transferred |
| http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html | x_refsource_CONFIRM x_transferred |
| http://www.vupen.com/english/advisories/2006/1205 | vdb-entry x_refsource_VUPEN x_transferred |
| http://www.securityfocus.com/bid/17342 | vdb-entry x_refsource_BID x_transferred |
| http://secunia.com/advisories/19493 | third-party-advisory x_refsource_SECUNIA x_transferred |
| https://issues.apache.org/struts/browse/STR-2781 | x_refsource_CONFIRM x_transferred |
| http://issues.apache.org/bugzilla/show_bug.cgi?id=38749 | x_refsource_CONFIRM x_transferred |
| http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html | vendor-advisory x_refsource_SUSE x_transferred |
| http://secunia.com/advisories/20117 | third-party-advisory x_refsource_SECUNIA x_transferred |