CoreCVE
Back

MEDIUM

Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags

Published Apr 9, 2009

Description

Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (2)

CWE-87

CWE-917

Expression Language Injection

References (5)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Apr 9, 2009
Updated Aug 7, 2024
Reserved Apr 9, 2009
Link CVE-2009-1275
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 16, 2026
Link CVE-2009-1275
Red Hat
Severity n/a
Public date n/a
Links CVE-2009-1275
GHSA-2C6Q-RGVJ-66RX