Apache Struts Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	34399
Class:	Input Validation Error
CVE:	CVE-2008-2025
Remote:	Yes
Local:	No
Published:	Apr 06 2009 12:00AM
Updated:	Apr 07 2009 02:26PM
Credit:	SUSE
Vulnerable:	SuSE SUSE Linux Enterprise Server 11 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Server 10 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 Apache Struts 2.0.12 Apache Struts 2.0.11 .2 Apache Struts 2.0.9 Apache Struts 2.0.8 Apache Struts 2.0.7 Apache Struts 2.0.6 Apache Struts 2.0.5 Apache Struts 2.0.4 Apache Struts 2.0.3 Apache Struts 2.0.2 Apache Struts 2.0.1 Apache Struts 2.0
Not Vulnerable:

Apache Struts Unspecified Cross Site Scripting Vulnerability

Apache Struts is prone to an unspecified cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

Apache Struts Unspecified Cross Site Scripting Vulnerability

An attacker can exploit this issue by tricking a victim into following a malicious URI.

Apache Struts Unspecified Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.

Apache Struts Unspecified Cross Site Scripting Vulnerability

References:

• Struts Homepage (Apache Software Foundation)