Apache Tiles Vulnerable to XSS via EL Expression Injection

MEDIUM 6.8CVE-2009-1275 · GHSA-2c6q-rgvj-66rx · Published 09/04/2009 · updated 16/06/2026

In short

CVE-2009-1275 is a MEDIUM (CVSS 6.8) vulnerability affecting org.apache.tiles:tiles-core, tiles (apache).
Chance of exploitation in the next 30 days (EPSS): 2.8%, higher than 86.5% of all vulnerabilities.
Fix: update to 2.1.2 or later.

Package	Affected versions	Patched versions
org.apache.tiles:tiles-core Maven	`≥ 2.1, < 2.1.2`	`2.1.2`
tiles apache	`= 2.1.0= 2.1.1`	No fix yet

Description

Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags.

NVD description

Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags.

References

nvd.nist.gov/vuln/detail/CVE-2009-1275 · ADVISORY
svn.apache.org/viewvc/tiles/framework/trunk/src/site/apt/security/security-bulletin-1.apt · WEB
securityfocus.com/bid/34657
issues.apache.org/struts/browse/TILES-351 · Vendor Advisory

More vulnerabilities in org.apache.tiles:tiles-core

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.tiles:tiles-core

Maven

≥ 2.1, < 2.1.2

2.1.2

tiles

apache

= 2.1.0= 2.1.1

No fix yet

Description

NVD description

Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags.