Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Apache Struts XWork '<s:submit>'错误页面跨站脚本攻击漏洞
Vulnerability Description
Apache Struts是美国阿帕奇（Apache）软件基金会负责维护的一个开源项目，是一套用于创建企业级Java Web应用的开源MVC框架，主要提供两个版本框架产品，Struts 1和Struts 2。 Apache Struts 2.2.3之前的2.x版本中存在跨站脚本攻击漏洞。当没有定义操作或方法时，借助“<s:submit>”标签（使用bash语法）传递的操作或方法名称再被用于生成错误页面之前，没有经过XWork的正确过滤。远程攻击者可以利用该漏洞执行任意HTML和脚本代码。
CVSS Information
N/A
Vulnerability Type
N/A