Apache Struts Multiple Cross-site Scripting Vulnerabilities

published 2012-02-07 14 y ago modified 2026-06-16 4 mo ago also GHSA-cmpm-jg8r-fv37 , EUVD-2022-3598

cvss: 4.3; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 56.6%; EPSS 56.6% chance of exploitation in 30 days, percentile 99%
public exploits: 1; Exploit-DB

Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders.

Patch / fix

fixed in 1

maven org.apache.struts:struts2-parent 2.1.2, 2.2.3.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2012-1006 updated 2026-08-04 cvss 4.3

struts2: multiple XSS flaws

Red Hat JBoss Enterprise Web Server 1 other
under investigation

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2012-02-02 First public exploit (EDB-18452)
2012-02-07 Published

Exploit prediction

56.61% chance of exploitation in the next 30 days, higher than 99% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-18452 Apache Struts - Multiple Persistent Cross-Site Scripting Vulnerabilities webapps, 2012-02-02

CVSS scores

assigned by	version	score	vector
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.struts:struts2-parent	<2.1.2 >=2.2, <2.2.3.1	2.1.2 2.2.3.1

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

CVE List CVE-2012-1006
GitHub Advisory GHSA-cmpm-jg8r-fv37
NVD CVE-2012-1006

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary