GitHub Advisoryadvisory · Maven

GHSA-q2cg-xf9p-h457 Incomplete exclude pattern in Apache Struts

HIGH Published 2022-05-17 Modified 2023-12-28 Official page ↗
Aliases
CVE-2015-1831
Ecosystem
Maven
Packages
org.apache.struts:struts2-core, org.apache.struts.xwork:xwork-core
Severity
High
Reviewed
2022-11-03

Affected packages

• Maven org.apache.struts:struts2-core: >= 2.0.0, < 2.3.20.1 → fixed in 2.3.20.1 • Maven org.apache.struts.xwork:xwork-core: >= 2.0.0, < 2.3.20.1 → fixed in 2.3.20.1

Description

The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. In Struts 2.3.20.1 a better set of exlude patterns was defined.

Related

Alias · CVE (1)

  • CVE-2015-1831 The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an… vulnerability

References