CVE-2008-6682 json
Apache Struts is vulnerable to Cross-site Scripting
published 2009-04-09 17 y ago modified 2026-06-16 4 mo ago also GHSA-jgcr-9c2q-rvp8 , EUVD-2022-4358
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.6%
- EPSS 5.6% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.
Patch / fix
- maven org.apache.struts:struts2-core 2.0.11.1, 2.1.1
Exploit prediction
5.61% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.struts:struts2-core | >=2.0.0, <2.0.11.1 >=2.1.0, <2.1.1 |
2.0.11.1 2.1.1 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
nabble.com
/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449.html
patch
-
nabble.com
/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449i20.ht
patch
-
github.com
/apache/struts/commit/09147ffad2b3046ed21af0f524c5088e2ac551e6
web
-
github.com
/apache/struts/commit/bd3f2f59c9b09f70aed3ebab6bb69b464ee2d6cb
web
-
github.com
/apache/struts/commit/dae026a0f0511f83852053bae9d5a622e7f80486
web
-
issues.apache.org
/struts/browse/WW-2427
web, vendor-advisory
-
issues.apache.org
/struts/browse/WW-2414
web, vendor-advisory
-
securityfocus.com
/bid/34686
vdb-entry
-
nvd.nist.gov
/vuln/detail/CVE-2008-6682
advisory
-
github.com
/apache/struts
package
-
web.archive.org
/web/20080610075918/http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-..
web
-
web.archive.org
/web/20080611112834/http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-..
web
-
web.archive.org
/web/20200229155553/http://www.securityfocus.com/bid/34686
web
Sources
- CVE List CVE-2008-6682
- GitHub Advisory GHSA-jgcr-9c2q-rvp8
- NVD CVE-2008-6682
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.