CVE-2011-2087 (GCVE-0-2011-2087)

Vulnerability from cvelistv5 – Published: 2011-05-13 17:00 – Updated: 2024-09-17 00:16
VLAI
Summary
Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T22:46:00.936Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.apache.org/jira/browse/WW-3597"
          },
          {
            "name": "ADV-2011-1198",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/1198"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://struts.apache.org/2.2.3/docs/version-notes-223.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.apache.org/jira/browse/WW-3608"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2011-05-13T17:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.apache.org/jira/browse/WW-3597"
        },
        {
          "name": "ADV-2011-1198",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/1198"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://struts.apache.org/2.2.3/docs/version-notes-223.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.apache.org/jira/browse/WW-3608"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-2087",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://issues.apache.org/jira/browse/WW-3597",
              "refsource": "CONFIRM",
              "url": "https://issues.apache.org/jira/browse/WW-3597"
            },
            {
              "name": "ADV-2011-1198",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2011/1198"
            },
            {
              "name": "http://struts.apache.org/2.2.3/docs/version-notes-223.html",
              "refsource": "CONFIRM",
              "url": "http://struts.apache.org/2.2.3/docs/version-notes-223.html"
            },
            {
              "name": "https://issues.apache.org/jira/browse/WW-3608",
              "refsource": "CONFIRM",
              "url": "https://issues.apache.org/jira/browse/WW-3608"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-2087",
    "datePublished": "2011-05-13T17:00:00.000Z",
    "dateReserved": "2011-05-13T00:00:00.000Z",
    "dateUpdated": "2024-09-17T00:16:06.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2011-2087",
      "date": "2026-07-29",
      "epss": "0.06127",
      "percentile": "0.92702"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5CF11DCF-6F6E-4E18-988E-E43918FBB8A6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BE3A90B7-C632-4D3E-9A4F-21E46D273B42\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"386538BE-F258-4870-8E11-750ADA228026\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B4CF15B9-3714-4206-9971-1F7D59E20483\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DFA32D87-65C7-4589-86B7-500BE3203CFA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"98C3FB11-4E24-4067-A3A9-021F849DAAE3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DCF2D72-90F1-4D1B-94A2-5BB3D8C086C2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"661F1610-9FCD-4FC1-BCA1-69C58E0A1389\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D9C89E22-B106-4EAB-90A1-0EA86C165737\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6E1BABB2-780E-47E0-87A9-A164906C8421\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AC32348E-7EF4-411C-9A44-CD041ABFA0E2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"94BD452B-AE41-4F7A-9DB9-4B1039582537\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"ACFDC53B-7B8E-4333-BC87-E01024EC9C21\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9F0818E7-B617-4C30-BFAC-9FE2F375F8BD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"50F4A58E-F3D4-4711-A37E-EA538B112371\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EFFCC96F-FD87-4495-B8A5-19D7898D5662\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DEA0424E-84B4-41BD-8E6C-93E2A77DD6CA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CEC53AE5-3640-4FE1-B0B1-EA26C5B9EB9B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"662A2E4B-A76A-4498-98A6-F90DF65C62B7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4E720B3A-4CFB-47FE-B80C-67C59D4C7FD4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CA687B56-A09B-4741-84F1-2BD9569A3F76\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0BC0E358-8B4D-480B-BFAE-966CB697310A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2B7E8E1C-C667-4AED-86A5-2BD0C62AAD76\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"88B3348C-1086-4A16-97E3-52DB65FF860A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3C65711D-9C5B-4644-A12D-82243CB6FB1E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FC1FA9A7-2C8E-4651-9400-190198528642\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FA9093C0-AE6A-4285-B159-8FDBF37E33D7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"267A1C33-1C95-41DA-8A01-6F20C7BE1772\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.\"}, {\"lang\": \"es\", \"value\": \"M\\u00faltiples vulnerabilidades de ejecuci\\u00f3n de secuencias de comandos en sitios cruzados (XSS) en los controladores de componente en el plugin javatemplates (tambi\\u00e9n conocido como plantillas de Java) en Apache Struts v2.x antes de v2.2.3, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\\u00e9s de un valor de par\\u00e1metro arbitrario a  .action URI, relacionado con a una manipulaci\\u00f3n incorrecta del valor de los atributos en un (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler. Java, (7) SubmitHandler.java y (8) TextFieldHandler.java.\"}]",
      "id": "CVE-2011-2087",
      "lastModified": "2024-11-21T01:27:33.717",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:P/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2011-05-13T17:05:45.253",
      "references": "[{\"url\": \"http://struts.apache.org/2.2.3/docs/version-notes-223.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.vupen.com/english/advisories/2011/1198\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://issues.apache.org/jira/browse/WW-3597\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\"]}, {\"url\": \"https://issues.apache.org/jira/browse/WW-3608\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://struts.apache.org/2.2.3/docs/version-notes-223.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.vupen.com/english/advisories/2011/1198\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://issues.apache.org/jira/browse/WW-3597\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\"]}, {\"url\": \"https://issues.apache.org/jira/browse/WW-3608\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2011-2087\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2011-05-13T17:05:45.253\",\"lastModified\":\"2026-04-29T01:13:23.040\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.\"},{\"lang\":\"es\",\"value\":\"M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en los controladores de componente en el plugin javatemplates (tambi\u00e9n conocido como plantillas de Java) en Apache Struts v2.x antes de v2.2.3, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de un valor de par\u00e1metro arbitrario a  .action URI, relacionado con a una manipulaci\u00f3n incorrecta del valor de los atributos en un (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler. Java, (7) SubmitHandler.java y (8) TextFieldHandler.java.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5CF11DCF-6F6E-4E18-988E-E43918FBB8A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE3A90B7-C632-4D3E-9A4F-21E46D273B42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"386538BE-F258-4870-8E11-750ADA228026\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B4CF15B9-3714-4206-9971-1F7D59E20483\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DFA32D87-65C7-4589-86B7-500BE3203CFA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"98C3FB11-4E24-4067-A3A9-021F849DAAE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DCF2D72-90F1-4D1B-94A2-5BB3D8C086C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"661F1610-9FCD-4FC1-BCA1-69C58E0A1389\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9C89E22-B106-4EAB-90A1-0EA86C165737\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E1BABB2-780E-47E0-87A9-A164906C8421\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AC32348E-7EF4-411C-9A44-CD041ABFA0E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"94BD452B-AE41-4F7A-9DB9-4B1039582537\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ACFDC53B-7B8E-4333-BC87-E01024EC9C21\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F0818E7-B617-4C30-BFAC-9FE2F375F8BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"50F4A58E-F3D4-4711-A37E-EA538B112371\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFFCC96F-FD87-4495-B8A5-19D7898D5662\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEA0424E-84B4-41BD-8E6C-93E2A77DD6CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CEC53AE5-3640-4FE1-B0B1-EA26C5B9EB9B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"662A2E4B-A76A-4498-98A6-F90DF65C62B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4E720B3A-4CFB-47FE-B80C-67C59D4C7FD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA687B56-A09B-4741-84F1-2BD9569A3F76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0BC0E358-8B4D-480B-BFAE-966CB697310A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B7E8E1C-C667-4AED-86A5-2BD0C62AAD76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"88B3348C-1086-4A16-97E3-52DB65FF860A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C65711D-9C5B-4644-A12D-82243CB6FB1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FC1FA9A7-2C8E-4651-9400-190198528642\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA9093C0-AE6A-4285-B159-8FDBF37E33D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"267A1C33-1C95-41DA-8A01-6F20C7BE1772\"}]}]}],\"references\":[{\"url\":\"http://struts.apache.org/2.2.3/docs/version-notes-223.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2011/1198\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://issues.apache.org/jira/browse/WW-3597\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\"]},{\"url\":\"https://issues.apache.org/jira/browse/WW-3608\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://struts.apache.org/2.2.3/docs/version-notes-223.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2011/1198\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://issues.apache.org/jira/browse/WW-3597\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\"]},{\"url\":\"https://issues.apache.org/jira/browse/WW-3608\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-01-28T22:22:24+00:00",
      "cve": "CVE-2011-2087",
      "id": "CVE-2011-2087",
      "initial_release_date": "2011-03-23T00:00:00+00:00",
      "product_status:under_investigation": "3",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "struts: Multiple XSS flaws in component handlers in javatemplates plug-in",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2011/cve-2011-2087.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2023-02-15T05:53:05Z",
      "cve": "CVE-2011-2087",
      "id": "CVE-2011-2087",
      "initial_release_date": "2023-02-15T05:53:05Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2011-2087",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2011-2087.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.