GitHub Advisoryadvisory · Maven

GHSA-vf8g-mpmw-qv87 Apache Struts vulnerable to Improper Input Validation

HIGH Published 2022-05-01 Modified 2022-06-07 Official page ↗
Aliases
CVE-2006-1546
Ecosystem
Maven
Packages
struts:struts
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-20
Reviewed
2022-06-07

Affected packages

• Maven struts:struts: < 1.2.9 → fixed in 1.2.9

Description

Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.

Related

Alias · CVE (1)

  • CVE-2006-1546 Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References