Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
Recommended action: Upgrade to 2.3.15.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.
Recommended action: Upgrade to 2.3.29 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
Recommended action: Upgrade to 2.5.13 or 2.3.34 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The REST Plugin in Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
Recommended action: Upgrade to 2.5.13 or 2.3.34 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.
Recommended action: Upgrade to 2.5.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.
Recommended action: Upgrade to 2.5.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.