CVE-2012-1006: Apache Struts 2 reflected XSS in showcase action parameters

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityThe flaw is a reflected XSS requiring user interaction with limited impact, but the affected components are old Struts showcase apps and EPSS is high.

What it is

Apache Struts 2.0.14 and 2.2.3 fail to properly sanitize several request parameters, allowing reflected cross-site scripting. The affected parameters are name and lastName in struts2-showcase/person/editPerson.action and clientName in struts2-rest-showcase/orders. Because the vulnerable endpoints are sample showcase applications, real-world exposure depends on whether those apps were deployed.

Impact

An attacker can execute arbitrary script in a victim's browser in the context of the affected site, enabling session theft, credential phishing or page defacement. The CVSS 2.0 vector shows partial integrity impact only, with no confidentiality or availability impact.

Attack surface

Reached over the network by crafting a URL with malicious values in the name, lastName or clientName parameters; no authentication is required, but the victim must be induced to follow the link or submit the crafted request, so user interaction is needed.

Exploitation

Not listed in CISA KEV and no ransomware association is documented. EPSS is high (0.58476, 99th percentile), but the references carry no exploit tags, so no confirmed public exploit is established by this record.

What to do

• Upgrade Apache Struts to a release later than 2.2.3 that addresses the XSS issues, or remove the struts2-showcase and struts2-rest-showcase sample applications from production.
• Apply output encoding to the name, lastName and clientName parameters before they are rendered in responses.
• Deploy a WAF rule or input filter that blocks script payloads in those parameters.
• Restrict network access to showcase or demo endpoints so they are not internet-facing.

Detection

• Search web access logs for requests to struts2-showcase/person/editPerson.action and struts2-rest-showcase/orders containing script tags or encoded script in name, lastName or clientName.
• Alert on reflected parameter values appearing unencoded in HTTP responses from Struts endpoints.
• Monitor for repeated or automated probing of these paths from single source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.