Vulnerability CVE-2011-1772 - CERT Civis.Net

Vulnerability Name:

CVE-2011-1772 (CCN-67354)

Assigned:

2011-05-10

Published:

2011-05-10

Updated:

2012-01-19

Summary:

Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.

CVSS v3 Severity:

3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

2.6 Low (CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
2.2 Low (Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
2.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2011-1772

Source: JVN
Type: UNKNOWN
JVN#25435092

Source: JVNDB
Type: UNKNOWN
JVNDB-2011-000106

Source: CCN
Type: SA44501
Apache Struts XWork <s:submit> Error Pages Cross-Site Scripting Vulnerability

Source: MISC
Type: Exploit
http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html

Source: MISC
Type: UNKNOWN
http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html

Source: CCN
Type: Apache Struts Web site
Struts

Source: CONFIRM
Type: UNKNOWN
http://struts.apache.org/2.2.3/docs/version-notes-223.html

Source: CCN
Type: S2-006
Multiple Cross-Site Scripting (XSS) in XWork generated error pages

Source: CONFIRM
Type: Exploit, Patch
http://struts.apache.org/2.x/docs/s2-006.html

Source: CCN
Type: OSVDB ID: 72238
Apache Struts Action / Method Names <s:submit> Tag XWork Error Pages XSS

Source: CCN
Type: OSVDB ID: 74447
Apache Struts XWork Nonexistent Method s:submit Element Internal Java Class Remote Path Disclosure

Source: BID
Type: Exploit
47784

Source: CCN
Type: BID-47784
Apache Struts XWork 's:submit' HTML Tag Cross Site Scripting Vulnerability

Source: MISC
Type: Exploit
http://www.ventuneac.net/security-advisories/MVSA-11-006

Source: VUPEN
Type: Vendor Advisory
ADV-2011-1198

Source: XF
Type: UNKNOWN
struts-xwork-xss(67354)

Source: CCN
Type: Apache Struts2 Web Site
Struts 2 s:submit XSS vulnerability

Source: CONFIRM
Type: Patch
https://issues.apache.org/jira/browse/WW-3579

Source: CCN
Type: IBM Security Bulletin 6620351 (Call Center for Commerce)
IBM Call Center and Apache Struts Struts upgrade strategy (various CVEs, see below)

Source: CCN
Type: IBM Security Bulletin 6620355 (Sterling Order Management)
IBM Sterling Order Management Apache Struts upgrade strategy (various CVEs, see below)

Vulnerable Configuration:

Configuration 1:

cpe:/a:apache:struts:2.0.0:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.4:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.5:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.6:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.7:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.8:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.9:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.10:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.11:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.11.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.11.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.12:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.13:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.14:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.0:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.4:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.5:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.6:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.8:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1.8.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.2.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.2.1.1:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:opensymphony:webwork:*:*:*:*:*:*:*:*

OR cpe:/a:opensymphony:xwork:*:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:apache:struts:2.0.8:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.10:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.0:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.0.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.2.1:*:*:*:*:*:*:*

Denotes that component is vulnerable