Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote
    attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to
    struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-
    showcase/orders. (CVE-2012-1006)

The remote web server hosts struts2-showcase, a demonstration application for the Struts 2 framework. Input passed via the 'name' and 'lastName' parameters to 'edit-person.action' is not properly sanitized, which can allow for arbitrary HTML and script code to be loaded onto the system and executed when a user visits 'list-people.action'.

The remote web server hosts Struts2-rest-showcase, a demonstration application for the Struts 2 framework. Input passed via the 'clientName' parameter to the orders page is not properly sanitized, which can allow for arbitrary HTML and script code to be loaded onto the system and executed when a user visits the orders page.

ID	Name	Product	Family	Severity
432928	SCA: security update for org.apache.struts:struts2-parent (GHSA-cmpm-jg8r-fv37)	Tenable Cloud Security	SCA Checks	medium
432928	SCA: security update for org.apache.struts:struts2-parent (GHSA-cmpm-jg8r-fv37)	Tenable Self-Hosted Container Security	SCA Checks	medium
60096	Apache Struts 2 struts2-showcase edit-person.action Persistent XSS	Nessus	CGI abuses : XSS	medium
60095	Apache Struts 2 struts2-rest-showcase orders 'clientName' Parameter Persistent XSS	Nessus	CGI abuses : XSS	medium

Detections

Analytics

CVE-2012-1006

medium

Tenable Plugins

medium

medium

medium

medium