CVE-2012-1007: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

May 14, 2022 (updated August 14, 2023)

Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or (3) struts-cookbook/processDyna.do.

References

exchange.xforce.ibmcloud.com/vulnerabilities/73052
github.com/advisories/GHSA-9848-v244-962p
nvd.nist.gov/vuln/detail/CVE-2012-1007

Detect and mitigate CVE-2012-1007 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →