Apache Struts CVE-2011-1772 Cross Site Scripting Vulnerability

Description

By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation (DMI) is enabled, the action name is generated dynamically base on request parameters. This allows to call non-existing page and method to produce error page with injected code as below

Affected Applications

Apache Struts

CVE References

Other References