medium4.3Public exploit code
CVE-2005-3745
Apache Struts Cross-site scripting Vulnerability
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Apache Struts 1.2.7 - Error Response Cross-Site Scripting2005-11-21 · remote · multiple · Verified
Impact
Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.struts:struts-core | <= 1.2.7 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Struts | Version 1.2.7 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://secunia.com/advisories/17677
- http://secunia.com/advisories/18341
- http://securityreason.com/securityalert/197
- http://securitytracker.com/id?1015257
- http://www.hacktics.com/AdvStrutsNov05.html
- http://www.osvdb.org/21021
- http://www.redhat.com/support/errata/RHSA-2006-0157.html
- http://www.redhat.com/support/errata/RHSA-2006-0161.html
- http://www.securityfocus.com/archive/1/417296/30/0/threaded
- http://www.securityfocus.com/bid/15512
- http://www.vupen.com/english/advisories/2005/2525
- https://lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3%40%3Cissues.struts.apache.org%3E
- https://lists.apache.org/thread.html/rf482c101a88445d73cc2e89dbf7f16ae00a4aa79a544a1e72b2326db%40%3Cissues.struts.apache.org%3E
- https://github.com/advisories/GHSA-9cjh-qmvx-436c
- https://nvd.nist.gov/vuln/detail/CVE-2005-3745
- https://lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3@%3Cissues.struts.apache.org%3E
- https://lists.apache.org/thread.html/rf482c101a88445d73cc2e89dbf7f16ae00a4aa79a544a1e72b2326db@%3Cissues.struts.apache.org%3E
- https://web.archive.org/web/20051230061138/http://www.hacktics.com/AdvStrutsNov05.html
- https://web.archive.org/web/20060315133810/http://securitytracker.com/alerts/2005/Nov/1015257.html
- https://web.archive.org/web/20060408105414/http://www.securityfocus.com/bid/15512
- https://web.archive.org/web/20201125023452/http://www.securityfocus.com/archive/1/417296/30/0/threaded
- https://web.archive.org/web/20201207010315/https://cxsecurity.com/issue/WLB-2005110055