Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1ybTI2LXcyNTMtOXF2N82uOg
Apache Struts Dojo Plugin XSS Vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ybTI2LXcyNTMtOXF2N82uOg
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: about 1 year ago
EPSS Percentage: 0.004
EPSS Percentile: 0.7391
Identifiers: GHSA-rm26-w253-9qv7, CVE-2007-6726
References:
- https://nvd.nist.gov/vuln/detail/CVE-2007-6726
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49884
- https://issues.apache.org/struts/browse/WW-2134
- http://www.dojotoolkit.org/0-4-3-and-updated-0-4-1-0-4-2-builds
- http://www.dojotoolkit.org/2007/05/26/0-4-3-released-0-4-2-and-0-4-1-users-should-upgrade-immediately
- http://www.dojotoolkit.org/releaseNotes/0.4.3
- http://www.securityfocus.com/bid/34660
- https://github.com/advisories/GHSA-rm26-w253-9qv7
Affected Packages
maven:org.apache.struts:struts2-dojo-plugin
Dependent packages: 6Dependent repositories: 274
Downloads:
Affected Version Ranges: >= 0.4.1, <= 0.4.2
Fixed in: 0.4.3
All affected versions:
All unaffected versions: 2.1.2, 2.1.6, 2.1.8, 2.2.1, 2.2.3, 2.3.1, 2.3.3, 2.3.4, 2.3.7, 2.3.8, 2.3.12, 2.3.14, 2.3.15, 2.3.16, 2.3.20, 2.3.24, 2.3.28, 2.3.29, 2.3.30, 2.3.31, 2.3.32, 2.3.33, 2.3.34, 2.3.35, 2.3.36, 2.3.37