GHSA-q2cg-xf9p-h457

ghsaUSosv

Incomplete exclude pattern in Apache Struts

view advisory published 2022-05-17Licence: CC-BY-4.0

The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. In Struts 2.3.20.1 a better set of exlude patterns was defined.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2015-1831US	high7.5	6.32% (94th)	—	2015-07-16
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.

references

External citations — patches, advisories, analysis.

https://github.com/apache/strutsPACKAGE
https://github.com/apache/struts/commit/d832747d647df343ed07a58b1b5e540a05a4d51bWEB
https://nvd.nist.gov/vuln/detail/CVE-2015-1831ADVISORY
https://struts.apache.org/docs/s2-024.htmlWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan