Apache Struts Dojo Plugin XSS Vulnerability

MEDIUM 4.3CVE-2007-6726 · GHSA-rm26-w253-9qv7 · Published 09/04/2009 · updated 16/06/2026

In short

CVE-2007-6726 is a MEDIUM (CVSS 4.3) vulnerability affecting org.apache.struts:struts2-dojo-plugin, struts (apache), dojo (dojotoolkit).
Chance of exploitation in the next 30 days (EPSS): 3.4%, higher than 89.0% of all vulnerabilities.
Fix: update to 0.4.3 or later.

Package	Affected versions	Patched versions
org.apache.struts:struts2-dojo-plugin Maven	`≥ 0.4.1, < 0.4.3`	`0.4.3`
struts apache	`= 2.0.9`	No fix yet
dojo dojotoolkit	`= 0.4.1= 0.4.2`	No fix yet

Description

Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/.

NVD description

Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/.

References

nvd.nist.gov/vuln/detail/CVE-2007-6726 · ADVISORY
exchange.xforce.ibmcloud.com/vulnerabilities/49884 · WEB
apache/struts-archive · WEB
issues.apache.org/struts/browse/WW-2134 · WEB
dojotoolkit.org/0-4-3-and-updated-0-4-1-0-4-2-builds · WEB
dojotoolkit.org/2007/05/26/0-4-3-released-0-4-2-and-0-4-1-users-should-upgrade-immediately · WEB
dojotoolkit.org/releaseNotes/0.4.3 · WEB
securityfocus.com/bid/34660 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free