CVE-2008-2025

Vulnerability

The vulnerability is a cross-site scripting (XSS) flaw in Apache Struts versions prior to specific SUSE packages: before 1.2.9-162.31.1 on SLE 11, before 1.2.9-108.2 on openSUSE 10.3, before 1.2.9-198.2 on openSUSE 11.0, and before 1.2.9-162.163.2 on openSUSE 11.1 [4]. The issue stems from insufficient quoting of parameters, allowing injection of arbitrary web script or HTML [1][2].

Exploitation

An attacker can exploit this vulnerability remotely without authentication, but user interaction is required (e.g., clicking a crafted link) [2]. The attack vector is network-based with medium complexity [4]. The exact vectors are unspecified, but the flaw involves improper handling of parameters in the Struts framework [1].

Impact

Successful exploitation leads to partial integrity impact, as the attacker can inject malicious script or HTML into the context of the affected application [2][4]. Confidentiality and availability are not directly affected, but the injected script can steal session cookies or perform actions on behalf of the user.

Mitigation

SUSE has released fixed packages: for SLE 11, version 1.2.9-162.37.1; for openSUSE 10.3, 1.2.9-108.2; for openSUSE 11.0, 1.2.9-198.2; for openSUSE 11.1, 1.2.9-162.163.2 [4]. The Secunia advisory initially listed the solution as unpatched [1], but SUSE later resolved the issue [4]. Users should update to the specified versions or apply the relevant SUSE security update SUSE-SR:2009:008 [4].