CVE-2006-1548

Apache Struts < 1.2.9 - Cross-Site Scripting via Parameter Name in Error Message

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.

References (10)

Core 10
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/25614
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1015856
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/1205
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/17342
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/19493
Various Sources x_refsource_confirm
https://issues.apache.org/struts/browse/STR-2781
Various Sources x_refsource_confirm
http://issues.apache.org/bugzilla/show_bug.cgi?id=38749
Various Sources vendor-advisory x_refsource_suse
http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/20117

Scores

EPSS 0.0533
EPSS Percentile 91.7%

Details

Status published
Products (2)
apache/struts < 1.2.8
struts/struts 0 - 1.2.9Maven
Published Mar 30, 2006
Tracked Since Feb 18, 2026