NVD

Id
48562  
Name
CVE-2009-1275  
Description
Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-04-09  
Modified Date
2009-04-29  
Seq
2009-1275  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
244910 48562 CVE-2009-1275 http://svn.apache.org/viewvc/tiles/framework/trunk/src/site/apt/security/security-bulletin-1.apt?revision=741913  View
244911 48562 CVE-2009-1275 34657  View
244912 48562 CVE-2009-1275 https://issues.apache.org/struts/browse/TILES-351  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
42323 JVNDB-2009-003330 Apache Struts などで使用される Apache Tiles における重要情報を取得される脆弱性 Apache Struts などで使用される Apache Tiles は、特定の条件で、Expression Language (EL) の表現を2回評価するため、クロスサイトスクリプティング攻撃を実行される、または重要情報を取得される脆弱性が存在します。 CVE-2009-1275 38706 CVE-2009-1275 48562 6.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-003330.html 2009-04-09 2012-06-26 View