{"action":"Upgrade org.apache.struts:struts2-core to 2.0.11.1 (2.0.x) or 2.1.1 (2.1.x) or later.","affected":[{"fixed":"2.0.11.1","introduced":"2.0.0"},{"fixed":"2.1.1","introduced":"2.1.0"}],"component":"org.apache.struts:struts2-core","cve_ids":["CVE-2008-6682"],"ecosystem":"Maven","epss":0.05614,"exploited":false,"fixed_versions":["2.0.11.1","2.1.1"],"ghsa_id":"GHSA-jgcr-9c2q-rvp8","id":"tcs_01M5N92WBGDM55KNE02DMD9AWZ","modified_at":"2024-12-06T05:31:39.196860Z","published_at":"2022-05-17T05:52:45Z","references":["https://osv.dev/vulnerability/GHSA-jgcr-9c2q-rvp8","https://nvd.nist.gov/vuln/detail/CVE-2008-6682","https://github.com/apache/struts/commit/09147ffad2b3046ed21af0f524c5088e2ac551e6","https://github.com/apache/struts/commit/bd3f2f59c9b09f70aed3ebab6bb69b464ee2d6cb","https://github.com/apache/struts/commit/dae026a0f0511f83852053bae9d5a622e7f80486","https://github.com/apache/struts","https://issues.apache.org/struts/browse/WW-2414","https://issues.apache.org/struts/browse/WW-2427","https://web.archive.org/web/20080610075918/http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449i20.html","https://web.archive.org/web/20080611112834/http://www.nabble.com/Feedback%3A-WW-2414%2C-XSS-attack-is-possible-if-using-%3Cs%3Aurl-...%3E-and-%3Cs%3Aa-...%3E-td14771449.html","https://web.archive.org/web/20200229155553/http://www.securityfocus.com/bid/34686"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-jgcr-9c2q-rvp8","url":"https://osv.dev/vulnerability/GHSA-jgcr-9c2q-rvp8"}],"summary":"Apache Struts is vulnerable to Cross-site Scripting"}