{
  "GSD": {
    "alias": "CVE-2005-3745",
    "description": "Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.",
    "id": "GSD-2005-3745",
    "references": [
      "https://www.suse.com/security/cve/CVE-2005-3745.html",
      "https://access.redhat.com/errata/RHSA-2006:0161",
      "https://access.redhat.com/errata/RHSA-2006:0157"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2005-3745"
      ],
      "details": "Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.",
      "id": "GSD-2005-3745",
      "modified": "2023-12-13T01:20:12.699669Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2005-3745",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "RHSA-2006:0161",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2006-0161.html"
          },
          {
            "name": "ADV-2005-2525",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2005/2525"
          },
          {
            "name": "21021",
            "refsource": "OSVDB",
            "url": "http://www.osvdb.org/21021"
          },
          {
            "name": "15512",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/15512"
          },
          {
            "name": "http://www.hacktics.com/AdvStrutsNov05.html",
            "refsource": "MISC",
            "url": "http://www.hacktics.com/AdvStrutsNov05.html"
          },
          {
            "name": "20051121 Security Advisory: Struts Error Message Cross Site Scripting",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/417296/30/0/threaded"
          },
          {
            "name": "RHSA-2006:0157",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2006-0157.html"
          },
          {
            "name": "1015257",
            "refsource": "SECTRACK",
            "url": "http://securitytracker.com/id?1015257"
          },
          {
            "name": "197",
            "refsource": "SREASON",
            "url": "http://securityreason.com/securityalert/197"
          },
          {
            "name": "17677",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/17677"
          },
          {
            "name": "18341",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/18341"
          },
          {
            "name": "[struts-issues] 20201207 [jira] [Created] (WW-5105) Tracking the fix commit of CVE-2005-3745 and CVE-2018-1327",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3@%3Cissues.struts.apache.org%3E"
          },
          {
            "name": "[struts-issues] 20201207 [jira] [Updated] (WW-5105) Tracking the fix commit of CVE-2005-3745 and CVE-2018-1327",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rf482c101a88445d73cc2e89dbf7f16ae00a4aa79a544a1e72b2326db@%3Cissues.struts.apache.org%3E"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:struts:1.2.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2005-3745"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.hacktics.com/AdvStrutsNov05.html",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.hacktics.com/AdvStrutsNov05.html"
            },
            {
              "name": "15512",
              "refsource": "BID",
              "tags": [
                "Exploit",
                "Patch"
              ],
              "url": "http://www.securityfocus.com/bid/15512"
            },
            {
              "name": "21021",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://www.osvdb.org/21021"
            },
            {
              "name": "17677",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/17677"
            },
            {
              "name": "1015257",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://securitytracker.com/id?1015257"
            },
            {
              "name": "RHSA-2006:0157",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://www.redhat.com/support/errata/RHSA-2006-0157.html"
            },
            {
              "name": "18341",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/18341"
            },
            {
              "name": "RHSA-2006:0161",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://www.redhat.com/support/errata/RHSA-2006-0161.html"
            },
            {
              "name": "197",
              "refsource": "SREASON",
              "tags": [],
              "url": "http://securityreason.com/securityalert/197"
            },
            {
              "name": "ADV-2005-2525",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2005/2525"
            },
            {
              "name": "20051121 Security Advisory: Struts Error Message Cross Site Scripting",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/417296/30/0/threaded"
            },
            {
              "name": "[struts-issues] 20201207 [jira] [Updated] (WW-5105) Tracking the fix commit of CVE-2005-3745 and CVE-2018-1327",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rf482c101a88445d73cc2e89dbf7f16ae00a4aa79a544a1e72b2326db@%3Cissues.struts.apache.org%3E"
            },
            {
              "name": "[struts-issues] 20201207 [jira] [Created] (WW-5105) Tracking the fix commit of CVE-2005-3745 and CVE-2018-1327",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3@%3Cissues.struts.apache.org%3E"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2020-12-08T05:15Z",
      "publishedDate": "2005-11-22T11:03Z"
    }
  }
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Application Server Release 2 Update 1 is now available.\n\nThis update contains an upgrade of several RHAPS components to newer\nreleases, including JOnAS 4.6.3, Tomcat 5.5.12 and Struts 1.2.8.\n\nThis update has been rated as having moderate security impact by the Red\nHat Security Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Application Server packages provide a J2EE Application Server and\nWeb container as well as the underlying Java stack.\n\nA denial of service flaw was found in the way Apache Tomcat displays\ndirectory listings. A remote attacker could cause Tomcat to consume large\namounts of CPU resources by sending multiple requests for a directory\ncontaining a large number of files.  The Common Vulnerabilities and\nExposures project has assigned the name CVE-2005-3510 to this issue.\nThis update contains a version of Apache Tomcat that will recover after\nthe aforementioned attack. Users are also advised to disable directory\nlisting for web directories that contain very large numbers of files.\n\nA cross-site scripting flaw was found in the way Struts displays error\npages. It may be possible for an attacker to construct a specially crafted\nURL which could fool a victim into believing they are viewing a trusted\nsite. The Common Vulnerabilities and Exposures project has assigned the\nname CVE-2005-3745 to this issue. Please note that this issue does not\naffect Struts running on Tomcat or JOnAS, which is our supported usage of\nStruts.\n\nAdditionally, this update replaces some other outdated packages with new\nversions. Several bug fixes and enhancements are included in these new\nversions.\n\nIMPORTANT: Before applying this update, read the detailed\ninstallation/upgrade instructions in the RELEASE_NOTES document.\n\nAll users of Red Hat Application Server should upgrade to these updated\npackages, which contain packages that are not vulnerable to these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2006:0161",
        "url": "https://access.redhat.com/errata/RHSA-2006:0161"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "172557",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=172557"
      },
      {
        "category": "external",
        "summary": "173929",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=173929"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0161.json"
      }
    ],
    "title": "Red Hat Security Advisory: RHAPS security and enhancement update",
    "tracking": {
      "current_release_date": "2024-11-22T00:23:58+00:00",
      "generator": {
        "date": "2024-11-22T00:23:58+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2006:0161",
      "initial_release_date": "2006-03-07T20:30:00+00:00",
      "revision_history": [
        {
          "date": "2006-03-07T20:30:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2006-03-07T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T00:23:58+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Application Server v2 4AS",
                "product": {
                  "name": "Red Hat Application Server v2 4AS",
                  "product_id": "Red Hat Application Server v2 4AS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_application_server:2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Application Server"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2005-3510",
      "discovery_date": "2005-11-07T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "237085"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat DoS",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Application Server v2 4AS"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2005-3510"
        },
        {
          "category": "external",
          "summary": "RHBZ#237085",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=237085"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2005-3510",
          "url": "https://www.cve.org/CVERecord?id=CVE-2005-3510"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-3510",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-3510"
        }
      ],
      "release_date": "2005-11-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2006-03-07T20:30:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.\n\nIMPORTANT: For this errata, use the \u0027up2date\u0027 command (with no arguments).\nDO NOT partially upgrade the packages for this errata as this can result\nin a non-consistent set of packages being installed.\n\nThe update will cause applications to be undeployed from the server.\nRedeploy all desired applications after the upgrade -- rerun GenIC for\nfaster deployment by the server as it will not have to replace stubs\nfrom the previous version on the fly.\n\nThe \u0027jeremie\u0027 protocol option for the JOnAS J2EE Application Server is now\ndeprecated and unsupported. If your JOnAS server is using the \u0027jeremie\u0027\nprotocol option, make sure you change the configuration to use the \u0027jrmp\u0027\nprotocol instead before restarting the server. A server configured to use\nthe \u0027jeremie\u0027 protocol may not function properly after the upgrade.",
          "product_ids": [
            "Red Hat Application Server v2 4AS"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2006:0161"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat DoS"
    },
    {
      "cve": "CVE-2005-3745",
      "discovery_date": "2005-11-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1617838"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Application Server v2 4AS"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2005-3745"
        },
        {
          "category": "external",
          "summary": "RHBZ#1617838",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617838"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2005-3745",
          "url": "https://www.cve.org/CVERecord?id=CVE-2005-3745"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-3745",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-3745"
        }
      ],
      "release_date": "2005-11-21T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2006-03-07T20:30:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.\n\nIMPORTANT: For this errata, use the \u0027up2date\u0027 command (with no arguments).\nDO NOT partially upgrade the packages for this errata as this can result\nin a non-consistent set of packages being installed.\n\nThe update will cause applications to be undeployed from the server.\nRedeploy all desired applications after the upgrade -- rerun GenIC for\nfaster deployment by the server as it will not have to replace stubs\nfrom the previous version on the fly.\n\nThe \u0027jeremie\u0027 protocol option for the JOnAS J2EE Application Server is now\ndeprecated and unsupported. If your JOnAS server is using the \u0027jeremie\u0027\nprotocol option, make sure you change the configuration to use the \u0027jrmp\u0027\nprotocol instead before restarting the server. A server configured to use\nthe \u0027jeremie\u0027 protocol may not function properly after the upgrade.",
          "product_ids": [
            "Red Hat Application Server v2 4AS"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2006:0161"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2006-0254",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2006-01-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "430646"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat examples XSS",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Application Server v2 4AS"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2006-0254"
        },
        {
          "category": "external",
          "summary": "RHBZ#430646",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430646"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2006-0254",
          "url": "https://www.cve.org/CVERecord?id=CVE-2006-0254"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2006-0254",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-0254"
        }
      ],
      "release_date": "2006-01-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2006-03-07T20:30:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.\n\nIMPORTANT: For this errata, use the \u0027up2date\u0027 command (with no arguments).\nDO NOT partially upgrade the packages for this errata as this can result\nin a non-consistent set of packages being installed.\n\nThe update will cause applications to be undeployed from the server.\nRedeploy all desired applications after the upgrade -- rerun GenIC for\nfaster deployment by the server as it will not have to replace stubs\nfrom the previous version on the fly.\n\nThe \u0027jeremie\u0027 protocol option for the JOnAS J2EE Application Server is now\ndeprecated and unsupported. If your JOnAS server is using the \u0027jeremie\u0027\nprotocol option, make sure you change the configuration to use the \u0027jrmp\u0027\nprotocol instead before restarting the server. A server configured to use\nthe \u0027jeremie\u0027 protocol may not function properly after the upgrade.",
          "product_ids": [
            "Red Hat Application Server v2 4AS"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2006:0161"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat examples XSS"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated Red Hat Application Server components are now available including a\nsecurity update for Struts.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Application Server packages provide a J2EE Application Server and\nWeb container as well as the underlying Java stack.\n\nA cross-site scripting flaw was found in the way Struts displays error\npages. It may be possible for an attacker to construct a specially crafted\nURL which could fool a victim into believing they are viewing a trusted\nsite. The Common Vulnerabilities and Exposures project assigned the\nname CVE-2005-3745 to this issue. Please note that this issue does not\naffect Struts running on Tomcat or JOnAS, which is our supported usage of\nStruts.\n\nAll users of Red Hat Application Server should upgrade to these updated\npackages, which contain Struts version 1.2.8 which is not vulnerable to\nthis issue.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2006:0157",
        "url": "https://access.redhat.com/errata/RHSA-2006:0157"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "173929",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=173929"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0157.json"
      }
    ],
    "title": "Red Hat Security Advisory: struts security update for Red Hat Application Server",
    "tracking": {
      "current_release_date": "2024-11-22T00:08:15+00:00",
      "generator": {
        "date": "2024-11-22T00:08:15+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2006:0157",
      "initial_release_date": "2006-01-11T18:38:00+00:00",
      "revision_history": [
        {
          "date": "2006-01-11T18:38:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2006-01-11T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T00:08:15+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Application Server 3AS",
                "product": {
                  "name": "Red Hat Application Server 3AS",
                  "product_id": "Red Hat Application Server 3AS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_application_server:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Application Server"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2005-3745",
      "discovery_date": "2005-11-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1617838"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Application Server 3AS"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2005-3745"
        },
        {
          "category": "external",
          "summary": "RHBZ#1617838",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617838"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2005-3745",
          "url": "https://www.cve.org/CVERecord?id=CVE-2005-3745"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-3745",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-3745"
        }
      ],
      "release_date": "2005-11-21T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2006-01-11T18:38:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Application Server 3AS"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2006:0157"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.struts:struts-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2005-3745"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-18T23:52:44Z",
    "nvd_published_at": "2005-11-22T11:03:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.",
  "id": "GHSA-9cjh-qmvx-436c",
  "modified": "2023-09-18T23:52:44Z",
  "published": "2022-05-01T02:20:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-3745"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3@%3Cissues.struts.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rf482c101a88445d73cc2e89dbf7f16ae00a4aa79a544a1e72b2326db@%3Cissues.struts.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20051230061138/http://www.hacktics.com/AdvStrutsNov05.html"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20060315133810/http://securitytracker.com/alerts/2005/Nov/1015257.html"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20060408105414/http://www.securityfocus.com/bid/15512"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20201125023452/http://www.securityfocus.com/archive/1/417296/30/0/threaded"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20201207010315/https://cxsecurity.com/issue/WLB-2005110055"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2006-0157.html"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2006-0161.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Apache Struts Cross-site scripting Vulnerability"
}