VYPR
← All advisories
Moderate severityNVD Advisory· Published Apr 9, 2009· Updated Jun 16, 2026

CVE-2008-6682

CVE-2008-6682

Description

Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.struts:struts2-coreMaven
>= 2.0.0, < 2.0.11.12.0.11.1
org.apache.struts:struts2-coreMaven
>= 2.1.0, < 2.1.12.1.1

Affected products

6
  • Apache/Struts5 versions
    cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:struts:2.1:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:maven/org.apache.struts/struts2-core
    Range: >= 2.0.0, < 2.0.11.1

Patches

Vulnerability mechanics

References

13

News mentions

0

No linked articles in our index yet.