Open mend-for-github-com[bot] opened 3 years ago
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
CVE-2008-2025 - Low Severity Vulnerability
Vulnerable Library - struts-taglib-1.3.8.jar
Apache Struts
Library home page: http://struts.apache.org
Path to dependency file: /foxtrot-core/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/struts/struts-taglib/1.3.8/struts-taglib-1.3.8.jar,/home/wss-scanner/.m2/repository/org/apache/struts/struts-taglib/1.3.8/struts-taglib-1.3.8.jar,/home/wss-scanner/.m2/repository/org/apache/struts/struts-taglib/1.3.8/struts-taglib-1.3.8.jar,/home/wss-scanner/.m2/repository/org/apache/struts/struts-taglib/1.3.8/struts-taglib-1.3.8.jar,/home/wss-scanner/.m2/repository/org/apache/struts/struts-taglib/1.3.8/struts-taglib-1.3.8.jar
Dependency Hierarchy: - foxtrot-common-6.3.1-7.jar (Root Library) - common-utils-1.4.jar - maven-dependency-plugin-3.1.1.jar - maven-reporting-impl-2.3.jar - doxia-site-renderer-1.4.jar - velocity-tools-2.0.jar - :x: **struts-taglib-1.3.8.jar** (Vulnerable Library)
Found in HEAD commit: ffb8a6014463ce8aac1bf6e7dc9a23fc4a2a8adc
Found in base branch: master
Vulnerability Details
Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "insufficient quoting of parameters."
Publish Date: 2009-04-09
URL: CVE-2008-2025
CVSS 3 Score Details (3.7)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-2025
Release Date: 2009-04-09
Fix Resolution: org.apache.struts:struts-taglib:1.4.0