CVE-2008-2025 (Medium) detected in struts-taglib-1.3.8.jar

[mend-bolt-for-github]

CVE-2008-2025 - Medium Severity Vulnerability

Vulnerable Library - struts-taglib-1.3.8.jar

Apache Struts

Library home page: http://struts.apache.org

Path to dependency file: madness/sub7/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/struts/struts-taglib/1.3.8/struts-taglib-1.3.8.jar,madness/sub7/target/madness-sub7/WEB-INF/lib/struts-taglib-1.3.8.jar

Dependency Hierarchy:

• velocity-tools-2.0.jar (Root Library)
  • ❌ struts-taglib-1.3.8.jar (Vulnerable Library)

Found in HEAD commit: 5efacc343770cbc0e414475474985665191deca8

Vulnerability Details

Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "insufficient quoting of parameters."

Publish Date: 2009-04-09

URL: CVE-2008-2025

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-2025

Release Date: 2009-04-09

Fix Resolution: org.apache.struts:struts-taglib:1.4.0

---

Step up your Open Source Security Game with WhiteSource here