I'm just curious about this. Say the system was 100% patched up. Should the administrator also be responsible for cross-site scripting issues?
This might get closed for being argumentative, but it seems to be the responsibility of the admin to get the patches in place and fix/contain problems, and the developer is responsible for the actual fix to the application/site.
Admins can't patch what there's no patch for. But they do have to be responsible for trying to clean up the mess (disaster/data recovery) and containment (monitoring for problems, detecting an issue, restoring service, etc.)
The answer is either 'all of the above', or 'depends on the environment'.
I am sure some issues may be mitigated by certain configurations on the server. Therefor, the sysadmin should fix and modify any configurations to avoid any issues.
But the person who developed the code, should be fixing the code. Or at least it should be someone with a strong background in software development or security.