CVE-2011-1772
Cross-site Scripting in Apache Struts
EPSS 33.1%
描述
Multiple Cross-Site Scripting (XSS) in XWork generated error pages in Apache Struts. By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation (DMI) is enabled, the action name is generated dynamically base on request parameters. This allows to call non-existing page and method to produce error page with injected code as below. As of Struts 2.2.3 the action names are escaped when automatically generated error pages are rendered.
如何修補 CVE-2011-1772
要修補 CVE-2011-1772,請將受影響套件升級到下列已修補版本。
- —升級至 2.2.3 或更新版本
CVE-2011-1772 正在被利用嗎?
中等 — EPSS 為 33.1%,可持續追蹤但非最高優先。
受影響套件(1)
- from 0, < 2.2.3