Bug 173929 - CVE-2005-3745 struts cross site scripting flaw
CVE-2005-3745 struts cross site scripting flaw
Status: CLOSED ERRATA
Product: Red Hat Application Server
Classification: Retired
Component: struts (Show other bugs)
2.0
All Linux
medium Severity low
: ---
: ---
Assigned To: Fernando Nasser
http://www.hacktics.com/AdvStrutsNov0...
impact=low,public=20051121,reported=2...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2005-11-22 14:26 EST by Josh Bressers
Modified: 2007-04-18 13:34 EDT (History)
0 users

See Also:
Fixed In Version: RHSA-2006-0161
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-03-07 15:25:46 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2006:0157 normal SHIPPED_LIVE Low: struts security update for Red Hat Application Server 2006-01-11 00:00:00 EST
Red Hat Product Errata RHSA-2006:0161 normal SHIPPED_LIVE Moderate: RHAPS security and enhancement update 2006-03-07 00:00:00 EST

  None (edit)
Description Josh Bressers 2005-11-22 14:26:28 EST
Struts has a cross site scripting vulnerability in the way it displays error
pages.  This issue should not affect struts running on tomcat, which is our
supported usage of struts.  It is possible there are customers using this
package in an unsupported manner which will be vulnerable to this issue.

Please see the URL field for more information.
Comment 1 Josh Bressers 2005-11-22 14:34:14 EST
This issue should affect both RHAPS and RHAPS2.
Comment 7 Mark J. Cox 2005-12-20 09:54:42 EST
Moving to impact low instead of moderate (justification: "This issue should not
affect struts running on tomcat, which is our supported usage of struts. ")
Comment 9 Red Hat Bugzilla 2006-01-11 13:34:39 EST
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2006-0157.html
Comment 10 Red Hat Bugzilla 2006-03-07 15:25:47 EST
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2006-0161.html

Note You need to log in before you can comment on or make changes to this bug.