Apache Struts Dojo Plugin XSS Vulnerability
Date: 2022-05
Affected: maven/org.apache.struts:struts2-dojo-plugin
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2007-6726
CWE: CWE-79

Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) `xip_client.html` and (2) `xip_server.html` in `src/io/`.


Mitigations:

Architectural layers (MAESTRO):