GHSA-qcfc-hmrc-59x7
Apache Struts 2 is Missing XML Validation
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2025-68493
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Description
Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.apache.struts:struts2-core | introduced 2.0.0, last affected 2.3.37 |
| Maven · org.apache.struts:struts2-core | introduced 2.5.0, last affected 2.5.33 |
| Maven · org.apache.struts:struts2-core | introduced 6.0.0, fixed 6.1.1 |
| Maven · com.opensymphony:xwork | introduced 2.0.0 |
| Maven · org.apache.struts.xwork:xwork-core | introduced 2.2.1 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2025-68493 ADVISORY
- https://cwiki.apache.org/confluence/display/WW/S2-069 WEB
- https://github.com/apache/struts PACKAGE
- http://www.openwall.com/lists/oss-security/2026/01/11/2 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |