CVE-2006-1548: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

May 1, 2022 (updated June 7, 2022)

Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.

References

exchange.xforce.ibmcloud.com/vulnerabilities/25614
github.com/advisories/GHSA-p3vw-fvwx-qcv5
nvd.nist.gov/vuln/detail/CVE-2006-1548

Code Behaviors & Features

Detect and mitigate CVE-2006-1548 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →