CVE-2008-6682
Apache Struts is vulnerable to Cross-site Scripting
EPSS 1.4%
Description
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.
How to fix CVE-2008-6682
To remediate CVE-2008-6682, upgrade the affected package to a fixed version below.
- Maven/org.apache.struts:struts2-core—upgrade to 2.0.11.1 or later
Is CVE-2008-6682 being exploited?
Low — EPSS is 1.4%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 2.0.0, < 2.0.11.1