cve-2011-1772
Vulnerability from cvelistv5
Published
2011-05-13 17:00
Modified
2024-08-06 22:37
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
References
secalert@redhat.comhttp://jvn.jp/en/jp/JVN25435092/index.html
secalert@redhat.comhttp://jvndb.jvn.jp/jvndb/JVNDB-2011-000106
secalert@redhat.comhttp://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html
secalert@redhat.comhttp://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.htmlExploit
secalert@redhat.comhttp://struts.apache.org/2.2.3/docs/version-notes-223.html
secalert@redhat.comhttp://struts.apache.org/2.x/docs/s2-006.htmlExploit, Patch
secalert@redhat.comhttp://www.securityfocus.com/bid/47784Exploit
secalert@redhat.comhttp://www.ventuneac.net/security-advisories/MVSA-11-006Exploit
secalert@redhat.comhttp://www.vupen.com/english/advisories/2011/1198Vendor Advisory
secalert@redhat.comhttps://issues.apache.org/jira/browse/WW-3579Patch
af854a3a-2127-422b-91ae-364da2661108http://jvn.jp/en/jp/JVN25435092/index.html
af854a3a-2127-422b-91ae-364da2661108http://jvndb.jvn.jp/jvndb/JVNDB-2011-000106
af854a3a-2127-422b-91ae-364da2661108http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html
af854a3a-2127-422b-91ae-364da2661108http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://struts.apache.org/2.2.3/docs/version-notes-223.html
af854a3a-2127-422b-91ae-364da2661108http://struts.apache.org/2.x/docs/s2-006.htmlExploit, Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/47784Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.ventuneac.net/security-advisories/MVSA-11-006Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2011/1198Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://issues.apache.org/jira/browse/WW-3579Patch
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T22:37:25.810Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "ADV-2011-1198",
                  tags: [
                     "vdb-entry",
                     "x_refsource_VUPEN",
                     "x_transferred",
                  ],
                  url: "http://www.vupen.com/english/advisories/2011/1198",
               },
               {
                  name: "47784",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/47784",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://struts.apache.org/2.x/docs/s2-006.html",
               },
               {
                  name: "JVNDB-2011-000106",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_JVNDB",
                     "x_transferred",
                  ],
                  url: "http://jvndb.jvn.jp/jvndb/JVNDB-2011-000106",
               },
               {
                  name: "JVN#25435092",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_JVN",
                     "x_transferred",
                  ],
                  url: "http://jvn.jp/en/jp/JVN25435092/index.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://struts.apache.org/2.2.3/docs/version-notes-223.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://www.ventuneac.net/security-advisories/MVSA-11-006",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://issues.apache.org/jira/browse/WW-3579",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2011-05-10T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2012-01-19T10:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "ADV-2011-1198",
               tags: [
                  "vdb-entry",
                  "x_refsource_VUPEN",
               ],
               url: "http://www.vupen.com/english/advisories/2011/1198",
            },
            {
               name: "47784",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/47784",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://struts.apache.org/2.x/docs/s2-006.html",
            },
            {
               name: "JVNDB-2011-000106",
               tags: [
                  "third-party-advisory",
                  "x_refsource_JVNDB",
               ],
               url: "http://jvndb.jvn.jp/jvndb/JVNDB-2011-000106",
            },
            {
               name: "JVN#25435092",
               tags: [
                  "third-party-advisory",
                  "x_refsource_JVN",
               ],
               url: "http://jvn.jp/en/jp/JVN25435092/index.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://struts.apache.org/2.2.3/docs/version-notes-223.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://www.ventuneac.net/security-advisories/MVSA-11-006",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://issues.apache.org/jira/browse/WW-3579",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2011-1772",
      datePublished: "2011-05-13T17:00:00",
      dateReserved: "2011-04-19T00:00:00",
      dateUpdated: "2024-08-06T22:37:25.810Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2011-1772\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2011-05-13T17:05:44.267\",\"lastModified\":\"2025-04-11T00:51:21.963\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.\"},{\"lang\":\"es\",\"value\":\"Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en  XWork en Apache Struts v2.x anterior a v2.2.3, y OpenSymphony XWork en OpenSymphony WebWork, permite a atacantes remotos inyectar código web script o HTML a través de vectores que implican (1) un \\\"action name\\\", (2) la acción atributo de un elemento \\\"s:submit\\\", o (3) el atributo del método del elemento \\\"s:submit\\\".\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:H/Au:N/C:N/I:P/A:N\",\"baseScore\":2.6,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"HIGH\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":4.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5CF11DCF-6F6E-4E18-988E-E43918FBB8A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE3A90B7-C632-4D3E-9A4F-21E46D273B42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"386538BE-F258-4870-8E11-750ADA228026\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B4CF15B9-3714-4206-9971-1F7D59E20483\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DFA32D87-65C7-4589-86B7-500BE3203CFA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"98C3FB11-4E24-4067-A3A9-021F849DAAE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DCF2D72-90F1-4D1B-94A2-5BB3D8C086C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"661F1610-9FCD-4FC1-BCA1-69C58E0A1389\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9C89E22-B106-4EAB-90A1-0EA86C165737\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E1BABB2-780E-47E0-87A9-A164906C8421\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AC32348E-7EF4-411C-9A44-CD041ABFA0E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"94BD452B-AE41-4F7A-9DB9-4B1039582537\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ACFDC53B-7B8E-4333-BC87-E01024EC9C21\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F0818E7-B617-4C30-BFAC-9FE2F375F8BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"50F4A58E-F3D4-4711-A37E-EA538B112371\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFFCC96F-FD87-4495-B8A5-19D7898D5662\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEA0424E-84B4-41BD-8E6C-93E2A77DD6CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CEC53AE5-3640-4FE1-B0B1-EA26C5B9EB9B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"662A2E4B-A76A-4498-98A6-F90DF65C62B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4E720B3A-4CFB-47FE-B80C-67C59D4C7FD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA687B56-A09B-4741-84F1-2BD9569A3F76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0BC0E358-8B4D-480B-BFAE-966CB697310A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B7E8E1C-C667-4AED-86A5-2BD0C62AAD76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"88B3348C-1086-4A16-97E3-52DB65FF860A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C65711D-9C5B-4644-A12D-82243CB6FB1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FC1FA9A7-2C8E-4651-9400-190198528642\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA9093C0-AE6A-4285-B159-8FDBF37E33D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"267A1C33-1C95-41DA-8A01-6F20C7BE1772\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opensymphony:webwork:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"09604417-9AF3-4F95-8E7A-695AD510168E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opensymphony:xwork:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D54BC82-0A21-42F7-9439-EB6BF2E95393\"}]}]}],\"references\":[{\"url\":\"http://jvn.jp/en/jp/JVN25435092/index.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://jvndb.jvn.jp/jvndb/JVNDB-2011-000106\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\"]},{\"url\":\"http://struts.apache.org/2.2.3/docs/version-notes-223.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://struts.apache.org/2.x/docs/s2-006.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"http://www.securityfocus.com/bid/47784\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\"]},{\"url\":\"http://www.ventuneac.net/security-advisories/MVSA-11-006\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\"]},{\"url\":\"http://www.vupen.com/english/advisories/2011/1198\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://issues.apache.org/jira/browse/WW-3579\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\"]},{\"url\":\"http://jvn.jp/en/jp/JVN25435092/index.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://jvndb.jvn.jp/jvndb/JVNDB-2011-000106\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\"]},{\"url\":\"http://struts.apache.org/2.2.3/docs/version-notes-223.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://struts.apache.org/2.x/docs/s2-006.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"http://www.securityfocus.com/bid/47784\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\"]},{\"url\":\"http://www.ventuneac.net/security-advisories/MVSA-11-006\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\"]},{\"url\":\"http://www.vupen.com/english/advisories/2011/1198\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://issues.apache.org/jira/browse/WW-3579\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
   },
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.