CVE-2011-1772
NoneCVSS
—
EPSS
33.3%
Published
May 13, 2011
CISA due date
—
The record
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.struts:struts2-core | 0 | 2.2.3 |
| maven | org.apache.struts/struts2-core | 2-alpha0 | No fix |
Related vulnerabilities
- GHSA-qcfc-hmrc-59x7 Apache Struts 2 is Missing XML Validation Also affects org.apache.struts:struts2-core
- CVE-2025-68493 Missing XML Validation vulnerability in Apache Struts, Apache Struts. Also affects org.apache.struts:struts2-core
- GHSA-rg58-xhh7-mqjw Apache Struts has a Denial of Service vulnerability Also affects org.apache.struts:struts2-core
- CVE-2025-66675 Apache Struts has a Denial of Service vulnerability Also affects org.apache.struts:struts2-core
- GHSA-xx7v-hqxh-cjr9 Apache Struts is Vulnerable to DoS via File Leak Also affects org.apache.struts:struts2-core
- CVE-2025-64775 Apache Struts is Vulnerable to DoS via File Leak Also affects org.apache.struts:struts2-core
- CVE-2024-53677 Apache Struts file upload logic is flawed Also affects org.apache.struts:struts2-core
- CVE-2012-1592 A local code execution issue exists in Apache Struts2 when processing malformed XSLT… Also affects org.apache.struts:struts2-core