GitHub Advisoryadvisory · Maven

GHSA-38cr-2ph5-frr9 Apache Struts REST Plugin can potentially allow a DoS attack

HIGH Published 2018-10-16 Modified 2024-01-05 Official page ↗
Aliases
CVE-2018-1327
Ecosystem
Maven
Packages
org.apache.struts:struts2-rest-plugin
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-91
Reviewed
2020-06-16

Affected packages

• Maven org.apache.struts:struts2-rest-plugin: >= 2.1.1, < 2.5.16 → fixed in 2.5.16

Description

The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.

Related

Alias · CVE (1)

  • CVE-2018-1327 The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request… vulnerability

Weakness · CWE (1)

  • CWE-91 XML Injection weakness

References