4.3

CVE-2006-1548

Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Struts Version <= 1.2.8
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.33% 0.916
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html
http://secunia.com/advisories/20117
http://secunia.com/advisories/19493
http://securitytracker.com/id?1015856
http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
http://www.securityfocus.com/bid/17342
http://www.vupen.com/english/advisories/2006/1205
http://issues.apache.org/bugzilla/show_bug.cgi?id=38749
https://exchange.xforce.ibmcloud.com/vulnerabilities/25614
https://issues.apache.org/struts/browse/STR-2781