GHSA-q2cg-xf9p-h457
Incomplete exclude pattern in Apache Struts
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2015-1831
Description
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. In Struts 2.3.20.1 a better set of exlude patterns was defined.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.apache.struts:struts2-core | introduced 2.0.0, fixed 2.3.20.1 |
| Maven · org.apache.struts.xwork:xwork-core | introduced 2.0.0, fixed 2.3.20.1 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2015-1831 ADVISORY
- https://github.com/apache/struts/commit/d832747d647df343ed07a58b1b5e540a05a4d51b WEB
- https://github.com/apache/struts PACKAGE
- https://struts.apache.org/docs/s2-024.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |