{"id":"CVE-2011-2087","url":"https://www.cyber-defence.io/tools/cve/CVE-2011-2087","generatedAt":"2026-10-27T17:57:26.055Z","title":"Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value…","description":"Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.","published":"2011-05-13T17:05:45.000Z","lastModified":"2026-06-16T23:30:40.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":4.3,"severity":"MEDIUM","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N"},"cwe":["CWE-79"],"affected":["apache/struts"],"epss":{"score":0.06127,"percentile":0.93394,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (6.13%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://struts.apache.org/2.2.3/docs/version-notes-223.html","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2011/1198","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://issues.apache.org/jira/browse/WW-3597","tags":["Exploit"],"source":"cve@mitre.org"},{"url":"https://issues.apache.org/jira/browse/WW-3608","source":"cve@mitre.org"},{"url":"http://struts.apache.org/2.2.3/docs/version-notes-223.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2011/1198","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://issues.apache.org/jira/browse/WW-3597","tags":["Exploit"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://issues.apache.org/jira/browse/WW-3608","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-2087","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}