GHSA-q2cg-xf9p-h457
Incomplete exclude pattern in Apache Struts
At a glance
- Published
- Updated
- CVE
- CVE-2015-1831
Description
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. In Struts 2.3.20.1 a better set of exlude patterns was defined.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.struts:struts2-core | introduced 2.0.0, fixed 2.3.20.1 |
| Maven · org.apache.struts.xwork:xwork-core | introduced 2.0.0, fixed 2.3.20.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-1831 ADVISORY
- https://github.com/apache/struts/commit/d832747d647df343ed07a58b1b5e540a05a4d51b WEB
- https://github.com/apache/struts PACKAGE
- https://struts.apache.org/docs/s2-024.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |