{"id":"CVE-2013-6348","published":"2013-11-02T21:00:00Z","modified":"2024-08-06T17:39:00Z","title":"Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject…","vendor":null,"product":null,"tier":"tail","description":{"text":"Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.06125,"percentile":0.93416,"provenance":"source"},"cwes":[],"references":[{"url":"http://osvdb.org/99047","tags":["vdb-entry","x_refsource_OSVDB"]},{"url":"http://packetstormsecurity.com/files/123805/Struts-2.3.15.3-Cross-Site-Scripting.html","tags":["x_refsource_MISC"]},{"url":"http://www.securitytracker.com/id/1029266","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://osvdb.org/99048","tags":["vdb-entry","x_refsource_OSVDB"]},{"url":"http://en.wooyun.org/bugs/wooyun-2013-034?2592","tags":["x_refsource_MISC"]},{"url":"http://seclists.org/fulldisclosure/2013/Oct/244","tags":["mailing-list","x_refsource_FULLDISC"]}],"priority":{"score":23.7,"factors":[{"name":"EPSS percentile","points":18.68},{"name":"Public exploit code","points":5.0}]},"affected":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":["<2.3.16"],"patched":["2.3.16"],"from":["GHSA-3g8j-jj54-3vjg"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2177","exploited":false,"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/123805/Struts-2.3.15.3-Cross-Site-Scripting.html"],"lineage":{"packageHistory":[{"cve":"CVE-2013-2251","published":"2013-07-20","fixed":"2.3.15.1","kev":true},{"cve":"CVE-2013-4316","published":"2013-09-30","fixed":"2.3.15.2","kev":false},{"cve":"CVE-2013-4310","published":"2013-09-30","fixed":"2.3.15.3","kev":false,"link":{"from":"CVE-2013-4310","to":"CVE-2013-6348","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.3.15.3","toFixed":"2.3.16","daysApart":33}]}},{"cve":"CVE-2013-6348","published":"2013-11-02","fixed":"2.3.16","kev":false},{"cve":"CVE-2014-0094","published":"2014-03-10","fixed":"2.3.16.2","kev":false,"link":{"from":"CVE-2013-6348","to":"CVE-2014-0094","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.3.16","toFixed":"2.3.16.2","daysApart":128}]}},{"cve":"CVE-2014-0112","published":"2014-04-29","fixed":"2.3.20","kev":false},{"cve":"CVE-2014-0113","published":"2014-04-29","fixed":"2.3.20","kev":false}],"package":"Maven:org.apache.struts:struts2-core"}}