Test ID:	1.3.6.1.4.1.25623.1.0.802422
Category:	Web application abuses
Title:	Apache Struts < 2.3.3 Showcase Multiple Persistent XSS Vulnerabilities
Summary:	Apache Struts Showcase is prone to multiple persistent; cross-site scripting (XSS) vulnerabilities.
Description:	Summary: Apache Struts Showcase is prone to multiple persistent cross-site scripting (XSS) vulnerabilities. Vulnerability Insight: Multiple flaws exist due to: - Input passed via the 'name' and 'lastName' parameter in '/struts2-showcase/person/editPerson.action' is not properly verified before it is returned to the user. - Input passed via the 'clientName' parameter in '/struts2-rest-showcase/orders' action is not properly verified before it is returned to the user. Vulnerability Impact: Successful exploitation could allow an attacker to execute arbitrary HTML code in a user's browser session in the context of a vulnerable application. Affected Software/OS: Apache Struts 1.3.10, 2.0.14, 2.2.3 and 2.3.1.2 are known to be affected. Solution: Update to version 2.3.3 or later. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2012-1006 BugTraq ID: 51902 http://www.securityfocus.com/bid/51902 http://secpod.org/advisories/SecPod_Apache_Struts_Multiple_Parsistant_XSS_Vulns.txt http://secpod.org/blog/?p=450 XForce ISS Database: apache-struts-multiple-xss(72888) https://exchange.xforce.ibmcloud.com/vulnerabilities/72888
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.