Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2005-3745 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Apache Struts

CWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)9 documents7 sources

Severity

4.3MEDIUMNVD

EPSS

59.1%

top 1.77%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Apache Struts

Timeline

PublishedNov 22

Latest updateMay 1

Description

Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDapache/struts1.2.7

Patches

Patch: www.hacktics.com ↗Patch: www.securityfocus.com ↗Patch: www.hacktics.com ↗

🔴Vulnerability Details

OSV

Apache Struts Cross-site scripting Vulnerability↗2022-05-01

▶

GHSA

Apache Struts Cross-site scripting Vulnerability↗2022-05-01

▶

CVEList

CVE-2005-3745: Cross-site scripting (XSS) vulnerability in Apache Struts 1↗2005-11-22

▶

💥Exploits & PoCs

Exploit-DB

Apache Struts 1.2.7 - Error Response Cross-Site Scripting↗2005-11-21

▶

📋Vendor Advisories

Red Hat

security flaw↗2005-11-21

▶

💬Community

Bugzilla

CVE-2005-3745 security flaw↗2018-08-16

▶

Bugzilla

CVE-2005-3745 struts cross site scripting flaw↗2005-11-22

▶

Bugzilla

CVE-2005-3745 struts cross site scripting flaw↗2005-11-22

▶