Read the docs
TI-2008-01947 Aliases CVE-2008-2025GHSA-wcgx-2hvx-5cwr

Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE…

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "insufficient quoting of parameters."

Why it matters now

EPSS 0.07911 94th percentileScored 2026-11-07
Fix Fixed struts:struts (Maven): 1.2.9-162.31.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—struts:struts (Maven)before 1.2.9-162.31.11.2.9-162.31.1Patch availableGHSA-wcgx-2hvx-5cwr
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • struts:struts (Maven) Vendor— Affected before 1.2.9-162.31.1 Fixed in 1.2.9-162.31.1 Patch available GHSA-wcgx-2hvx-5cwr

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:apache:struts:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableApache
cpe:2.3:a:apache:struts:1.1:*:*:*:*:*:*:*1.1VulnerableApache
cpe:2.3:a:apache:struts:1.2.4:*:*:*:*:*:*:*1.2.4VulnerableApache
cpe:2.3:a:apache:struts:1.2.7:*:*:*:*:*:*:*1.2.7VulnerableApache
cpe:2.3:a:apache:struts:1.2.8:*:*:*:*:*:*:*1.2.8VulnerableApache
cpe:2.3:o:novell:suse_linux:11:-:enterprise:*:*:*:*:*11Running onNovell
cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:*10.3Running onopenSUSE
cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*11.0Running onopenSUSE
cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*11.1Running onopenSUSE
  • cpe:2.3:a:apache:struts:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.2.4:*:*:*:*:*:*:* Versions 1.2.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.2.7:*:*:*:*:*:*:* Versions 1.2.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:1.2.8:*:*:*:*:*:*:* Versions 1.2.8 Vulnerable ·Apache
  • cpe:2.3:o:novell:suse_linux:11:-:enterprise:*:*:*:*:* Versions 11 Running on ·Novell
  • cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:* Versions 10.3 Running on ·openSUSE
  • cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:* Versions 11.0 Running on ·openSUSE
  • cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:* Versions 11.1 Running on ·openSUSE

Remediation

  • Fix · GHSA-wcgx-2hvx-5cwr struts:struts (Maven) Fixed in 1.2.9-162.31.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-2025
  2. 2026-10-03 Alias added: GHSA-wcgx-2hvx-5cwr

References

Patch 1

Advisory 2

Other 7

  • TI-2020-13278 Expression language injection in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-07171 Improper input validation in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-00357 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-08433 Improper input validation in Apache Struts KEVCVSS 3.1HIGH 8.1
See all 98 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences