CVE-2008-6682

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-04-09 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.

Affected products

Apache Struts: 2.0.6, 2.0.8, 2.0.9, 2.0.11, 2.1

References

http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449.html
http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449i20.html
http://www.securityfocus.com/bid/34686
https://issues.apache.org/struts/browse/WW-2414
https://issues.apache.org/struts/browse/WW-2427
http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449.html
http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449i20.html
http://www.securityfocus.com/bid/34686
https://issues.apache.org/struts/browse/WW-2414
https://issues.apache.org/struts/browse/WW-2427

Get alerted when CVE-2008-6682 or the next vulnerability affects your stack