Apache Struts is vulnerable to Cross-site Scripting

Description

References

• nvd.nist.gov/vuln/detail/CVE-2013-6348 · ADVISORY
• apache/struts · PACKAGE
• issues.apache.org/jira/browse/WW-4213 · WEB
• security-tracker.debian.org/tracker/CVE-2013-6348 · WEB
• svn.apache.org/viewvc · WEB
• ubuntu.com/security/CVE-2013-6348 · WEB
• packetstormsecurity.com/files/123805/Struts-2.3.15.3-Cross-Site-Scripting.html · WEB
• seclists.org/fulldisclosure/2013/Oct/244 · WEB
• en.wooyun.org/bugs/wooyun-2013-034 · Exploit
• osvdb.org/99047
• osvdb.org/99048
• securitytracker.com/id/1029266

More vulnerabilities in org.apache.struts:struts2-core

• CVE-2025-68493HIGH 8.1Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Str…
• CVE-2025-66675HIGH 8.2Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apac…
• CVE-2025-64775HIGH 7.5Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apac…
• CVE-2024-53677CRITICAL 9.8File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circums…
• CVE-2023-50164CRITICAL 9.8An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious …