{"api_version":"1","generated_at":"2026-07-23T07:36:13+00:00","cve":"CVE-2008-6682","urls":{"html":"https://cve.report/CVE-2008-6682","api":"https://cve.report/api/cve/CVE-2008-6682.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-6682","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-6682"},"summary":{"title":"CVE-2008-6682","description":"Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) \" (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.","state":"PUBLISHED","assigner":"mitre","published_at":"2009-04-09 15:08:35","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/34686","name":"http://www.securityfocus.com/bid/34686","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Apache Struts Multiple Cross Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449.html","name":"http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Nabble - Struts - User - Feedback: WW-2414, XSS attack is possible if using <s:url ...> and <s:a ...>","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://issues.apache.org/struts/browse/WW-2414","name":"https://issues.apache.org/struts/browse/WW-2414","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"[#WW-2414] Tags <s:url> and <s:a> do not encode URLs - Apache Struts JIRA","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449i20.html","name":"http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449i20.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Nabble - Struts - User - Feedback: WW-2414, XSS attack is possible if using <s:url ...> and <s:a ...>","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://issues.apache.org/struts/browse/WW-2427","name":"https://issues.apache.org/struts/browse/WW-2427","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"[#WW-2427] s:a does not HTML-escape \"href\" attribute value - Apache Struts JIRA","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-6682","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-6682","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"6682","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"struts","cpe6":"2.0.11","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"6682","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"struts","cpe6":"2.0.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"6682","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"struts","cpe6":"2.0.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"6682","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"struts","cpe6":"2.0.9","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"6682","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"struts","cpe6":"2.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2008-6682","qid":"997339","title":"Java (Maven) Security Update for org.apache.struts:struts2-core (GHSA-jgcr-9c2q-rvp8)"}]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T11:41:59.972Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"34686","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/34686"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://issues.apache.org/struts/browse/WW-2427"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449i20.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://issues.apache.org/struts/browse/WW-2414"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-01-11T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) \" (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2009-04-28T09:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"34686","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/34686"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://issues.apache.org/struts/browse/WW-2427"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449i20.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://issues.apache.org/struts/browse/WW-2414"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-6682","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) \" (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"34686","refsource":"BID","url":"http://www.securityfocus.com/bid/34686"},{"name":"http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449.html","refsource":"CONFIRM","url":"http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449.html"},{"name":"https://issues.apache.org/struts/browse/WW-2427","refsource":"CONFIRM","url":"https://issues.apache.org/struts/browse/WW-2427"},{"name":"http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449i20.html","refsource":"CONFIRM","url":"http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449i20.html"},{"name":"https://issues.apache.org/struts/browse/WW-2414","refsource":"CONFIRM","url":"https://issues.apache.org/struts/browse/WW-2414"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-6682","datePublished":"2009-04-09T15:00:00.000Z","dateReserved":"2009-04-09T00:00:00.000Z","dateUpdated":"2024-08-07T11:41:59.972Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-04-09 15:08:35","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*","matchCriteriaId":"4DCF2D72-90F1-4D1B-94A2-5BB3D8C086C2"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*","matchCriteriaId":"D9C89E22-B106-4EAB-90A1-0EA86C165737"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*","matchCriteriaId":"6E1BABB2-780E-47E0-87A9-A164906C8421"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*","matchCriteriaId":"94BD452B-AE41-4F7A-9DB9-4B1039582537"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:2.1:*:*:*:*:*:*:*","matchCriteriaId":"DEE2D92E-A527-469A-89A9-9685D8E08650"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"6682","Ordinal":"1","Title":"CVE-2008-6682","CVE":"CVE-2008-6682","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"6682","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) \" (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.","Type":"Description","Title":"CVE-2008-6682"},{"CveYear":"2008","CveId":"6682","Ordinal":"2","NoteData":"2009-04-09","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"6682","Ordinal":"3","NoteData":"2009-04-28","Type":"Other","Title":"Modified"}]}}}