Read the docs
TI-2008-06371 Aliases CVE-2008-6682GHSA-jgcr-9c2q-rvp8

Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before…

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.

Why it matters now

EPSS 0.05614 92nd percentileScored 2026-11-07
Fix Fixed org.apache.struts:struts2-core (Maven): 2.0.11.1, 2.1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.struts:struts2-core (Maven)2.0.0 to before 2.0.11.12.0.11.1Patch availableGHSA-jgcr-9c2q-rvp8
—org.apache.struts:struts2-core (Maven)2.1.0 to before 2.1.12.1.1Patch availableGHSA-jgcr-9c2q-rvp8
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.struts:struts2-core (Maven) Vendor— Affected 2.0.0 to before 2.0.11.1 Fixed in 2.0.11.1 Patch available GHSA-jgcr-9c2q-rvp8
  • org.apache.struts:struts2-core (Maven) Vendor— Affected 2.1.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-jgcr-9c2q-rvp8

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*2.0.6VulnerableApache
cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*2.0.8VulnerableApache
cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*2.0.9VulnerableApache
cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*2.0.11VulnerableApache
cpe:2.3:a:apache:struts:2.1:*:*:*:*:*:*:*2.1VulnerableApache
  • cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:* Versions 2.0.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:* Versions 2.0.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:* Versions 2.0.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:* Versions 2.0.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:struts:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-jgcr-9c2q-rvp8 org.apache.struts:struts2-core (Maven) Fixed in 2.0.11.1 Advisory →
  • Fix · GHSA-jgcr-9c2q-rvp8 org.apache.struts:struts2-core (Maven) Fixed in 2.1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-6682
  2. 2026-10-03 Alias added: GHSA-jgcr-9c2q-rvp8

References

Patch 2

Advisory 3

Other 7

  • TI-2020-13278 Expression language injection in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-07171 Improper input validation in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-00357 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-08433 Improper input validation in Apache Struts KEVCVSS 3.1HIGH 8.1
See all 98 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences