CVE-2012-1007
NoneCVSS
—
EPSS
32.8%
Published
Feb 7, 2012
CISA due date
—
The record
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or (3) struts-cookbook/processDyna.do.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.struts:struts-core | 0 | No fix |
| Maven | struts:struts | 0 | No fix |
Related vulnerabilities
- CVE-2016-1182 ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the… Also affects org.apache.struts:struts-core
- CVE-2016-1181 ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access… Also affects org.apache.struts:struts-core
- CVE-2015-0899 The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote… Also affects org.apache.struts:struts-core
- CVE-2005-3745 Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other… Also affects org.apache.struts:struts-core
- CVE-2006-1547 ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7… Also affects struts:struts
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79