CVE-2012-1006

描述

Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to `struts2-showcase/person/editPerson.action`, or the (3) clientName parameter to `struts2-rest-showcase/orders`.

如何修補 CVE-2012-1006

要修補 CVE-2012-1006,請將受影響套件升級到下列已修補版本。

• Maven/org.apache.struts:struts2-parent—升級至 2.1.2 或更新版本

CVE-2012-1006 正在被利用嗎?

可能 — EPSS 為 58.5%,屬於高被利用機率區間,建議優先修補。

受影響套件(1)

• from 0, < 2.1.2

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2012-1006
• WEBexchange.xforce.ibmcloud.com/vulnerabilities/72888
• WEBweb.archive.org/web/20120219225953/http://secpod.org/advisories/SecPod_Apache_Struts_Multiple_Parsistant_XSS_Vulns.txt
• WEBweb.archive.org/web/20131013214245/http://secpod.org/blog/?p=450