Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other…
Priority MEDIUM 42CWE-80Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-80.
Summary
Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
Why it matters now
EPSS 0.25707 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 2 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.struts:struts-core (Maven) | up to 1.2.7 | — | No fix listed | GHSA-9cjh-qmvx-436c |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.struts:struts-core (Maven) Vendor— Affected up to 1.2.7 Fixed in — No fix listed GHSA-9cjh-qmvx-436c
Remediation
Red Hat 2 advisories
- RHSA-2006:0161 Released 2006-03-07 · Red Hat rating ModerateRHAPS security and enhancement update
- Red Hat Application Server v2 4AS
- RHSA-2006:0157 Released 2006-01-11 · Red Hat rating Lowstruts security update for Red Hat Application Server
- Red Hat Application Server 3AS
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Application Server 3AS | Fixed | RHSA-2006:0157 |
| Red Hat Application Server v2 4AS | Fixed | RHSA-2006:0161 |
Timeline
- 2026-10-02 Threatist record created from CVE-2005-3745
- 2026-10-03 Alias added: GHSA-9cjh-qmvx-436c
References
Other 11
- ADV-2005-2525
- 21021
- [struts-issues] 20201207 [jira] [Created] (WW-5105) Tracking the fix commit of CVE-2005-3745 and CVE-2018-1327
- [struts-issues] 20201207 [jira] [Updated] (WW-5105) Tracking the fix commit of CVE-2005-3745 and CVE-2018-1327
- https://lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3@%3Cissues.struts.apache.org%3E
- https://lists.apache.org/thread.html/rf482c101a88445d73cc2e89dbf7f16ae00a4aa79a544a1e72b2326db@%3Cissues.struts.apache.org%3E
- https://web.archive.org/web/20051230061138/http://www.hacktics.com/AdvStrutsNov05.html
- https://web.archive.org/web/20060315133810/http://securitytracker.com/alerts/2005/Nov/1015257.html
- https://web.archive.org/web/20060408105414/http://www.securityfocus.com/bid/15512
- https://web.archive.org/web/20201125023452/http://www.securityfocus.com/archive/1/417296/30/0/threaded
- https://web.archive.org/web/20201207010315/https://cxsecurity.com/issue/WLB-2005110055
More Apache Struts vulnerabilities
- TI-2020-13278 Expression language injection in Apache Struts KEVCVSS 3.1CRITICAL 9.8
- TI-2017-07171 Improper input validation in Apache Struts KEVCVSS 3.1CRITICAL 9.8
- TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
- TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
- TI-2012-00357 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter… KEVCVSS 3.1CRITICAL 9.8
- TI-2018-08433 Improper input validation in Apache Struts KEVCVSS 3.1HIGH 8.1
Sources
- CVE-2005-3745 · CVE Program
- CVE-2005-3745 · NVD
- FIRST EPSS
- GHSA-9cjh-qmvx-436c · GitHub Advisory Database · CC BY 4.0
- CVE-2005-3745 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences