Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
58 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
Recommended action: Upgrade to 7.1.1 or 6.8.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
Recommended action: Upgrade to 7.1.1 or 6.8.0 by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
File upload logic is flawed vulnerability in Apache Struts. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload. If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067 .
Recommended action: Upgrade to 6.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
Recommended action: Upgrade to 6.3.0.2 or 2.5.33 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fix this issue.
Recommended action: Upgrade to 6.3.0.1, 6.1.2.2 or 2.5.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Denial of service via out of memory (OOM) owing to not properly checking of list bounds. When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings without checking their sizes. This could lead to OOM if developer has set struts.multipart.maxSize to a value equal or greater than the available memory. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater.
Recommended action: Upgrade to 6.1.2.1 or 2.5.31 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.
Recommended action: Upgrade to 2.5.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When the Struts2 debug mode is turned on, under certain conditions an arbitrary script may be executed in the 'Problem Report' screen. Also if JSP files are exposed to be accessed directly it's possible to execute an arbitrary script. It is generally not advisable to have debug mode switched on outside of the development environment. Debug mode should always be turned off in production setup. Also never expose JSPs files directly and hide them inside WEB-INF folder or define dedicated security constraints to block access to raw JSP files. Struts = 2.3.20 is not vulnerable to this attack. We recommend upgrading to Struts 2.3.20 or higher if turning off debug mode is not possible.
Recommended action: Upgrade to 2.3.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.
Recommended action: Upgrade to 2.1.1 or 2.0.11.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
Recommended action: Upgrade to 2.1.3 or 2.0.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple Cross-Site Scripting (XSS) in XWork generated error pages in Apache Struts. By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation (DMI) is enabled, the action name is generated dynamically base on request parameters. This allows to call non-existing page and method to produce error page with injected code as below. As of Struts 2.2.3 the action names are escaped when automatically generated error pages are rendered.
Recommended action: Upgrade to 2.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/.
Recommended action: Upgrade to 2.3.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Struts 2 action mapping mechanism supports the special parameter prefix action: which is intended to help with attaching navigational information to buttons within forms, under certain conditions this can be used to bypass security constraints. In Struts 2.3.15.3 the action mapping mechanism was changed to avoid circumventing security constraints. Two additional constants were introduced to steer behaviour of DefaultActionMapper: - struts.mapper.action.prefix.enabled - when set to false support for "action:" prefix is disabled, set to false by default - struts.mapper.action.prefix.crossNamespaces - when set to false, actions defined with "action:" prefix must be in the same namespace as current action
Recommended action: Upgrade to 2.3.15.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Struts 2.x before 2.3.28 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.
Recommended action: Upgrade to 2.3.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
XSLTResult allows for the location of a stylesheet being passed as a request parameter. In some circumstances this can be used to inject remotely executable code.
Recommended action: Upgrade to 2.3.28.1, 2.3.24.3 or 2.3.20.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.
Recommended action: Upgrade to 2.3.24.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
Recommended action: Upgrade to 2.3.15.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Struts 2 DefaultActionMapper used to support a method for short-circuit navigation state changes by prefixing parameters with "redirect:" or "redirectAction:", followed by a desired redirect target expression. This mechanism was intended to help with attaching navigational information to buttons within forms. Attackers could use this to redirect to arbitrary web sites and conduct phishing attacks. In Struts 2 before 2.3.15.1 the information following "redirect:" or "redirectAction:" can easily be manipulated to redirect to an arbitrary location.
Recommended action: Upgrade to 2.3.15.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.13 allows remote attackers to cause a denial of service via a null value for a URL field.
Recommended action: Upgrade to 2.5.13 or 2.3.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.
Recommended action: Upgrade to 2.5.1 or 2.3.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.
Recommended action: Upgrade to 2.3.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. In Struts 2.3.20.1 a better set of exlude patterns was defined.
Recommended action: Upgrade to 2.3.20.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
ValueStack defines special top object which represents root of execution context. It can be used to manipulate Struts' internals or can be used to affect container's settings. Applying better regex which includes pattern to exclude request parameters trying to use top object. This issue was patched in Struts 2.3.24.1.
Recommended action: Upgrade to 2.3.24.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.
Recommended action: Upgrade to 2.5.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/ values, which allows remote attackers to bypass the CSRF protection mechanism.
Recommended action: Upgrade to 2.3.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.