CVE-2012-1006

Vulnerability

Multiple cross-site scripting (XSS) vulnerabilities exist in Apache Struts versions 2.0.14 and 2.2.3 [1][2]. The flaws are caused by improper validation of input supplied via the name and lastName parameters in the struts2-showcase/person/editPerson.action endpoint, and the clientName parameter in the struts2-rest-showcase/orders endpoint [1][3]. An attacker can inject arbitrary web script or HTML through these parameters [1].

Exploitation

A remote attacker can exploit these vulnerabilities without requiring authentication [2]. The attacker must craft a malicious URL containing JavaScript or HTML in the vulnerable parameter and trick a victim into visiting it, typically via a link or embedded content [3]. No special network position beyond standard HTTP access is needed; the attack vector is network-based via HTTP GET request [1][2].

Impact

Successful exploitation allows the attacker to inject arbitrary web script or HTML into the victim's browser [1]. This can lead to cookie-based authentication credential theft, session hijacking, or defacement of the page [3]. The impact is primarily confidentiality and integrity compromise within the context of the affected application and the user's session.

Mitigation

Apache Struts users should upgrade to a patched version beyond 2.2.3 as soon as possible; the vulnerable versions are 2.0.14 and 2.2.3 [2]. No workaround is mentioned in the available references. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of February 2025.