GitHub Advisoryadvisory · Maven

GHSA-4qgj-9mvg-3929 Special top object can be used to access Struts' internals

HIGH Published 2022-05-14 Modified 2022-11-03 Official page ↗
Aliases
CVE-2015-5209
Ecosystem
Maven
Packages
org.apache.struts:struts2-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2022-11-03

Affected packages

• Maven org.apache.struts:struts2-core: < 2.3.24.1 → fixed in 2.3.24.1

Description

ValueStack defines special top object which represents root of execution context. It can be used to manipulate Struts' internals or can be used to affect container's settings. Applying better regex which includes pattern to exclude request parameters trying to use top object. This issue was patched in Struts 2.3.24.1.

Related

Alias · CVE (1)

  • CVE-2015-5209 Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References