CVE-2008-6682 (Medium) detected in struts2-core-2.0.5.jar - autoclosed

[mend-for-github-com]

CVE-2008-6682 - Medium Severity Vulnerability

Vulnerable Library - struts2-core-2.0.5.jar

Apache Struts 2

Library home page: http://struts.apache.org/struts2

Path to dependency file: /build.gradle

Path to vulnerable library: /radle/caches/modules-2/files-2.1/org.apache.struts/struts2-core/2.0.5/72d3b106b74c629c8764230c3931e4a7f39524d3/struts2-core-2.0.5.jar

Dependency Hierarchy:

• ❌ struts2-core-2.0.5.jar (Vulnerable Library)

Found in HEAD commit: d74adcb0970dfc5e766162c760da662aada1def1

Found in base branch: main

Vulnerability Details

Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.

Publish Date: 2009-04-09

URL: CVE-2008-6682

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2008-6682

Release Date: 2009-04-09

Fix Resolution: 2.0.11.1,2.1.1

---

⛑️ Automatic Remediation is available for this issue

[mend-for-github-com]

✔️ This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.