Cross-Site Request Forgery in Apache Struts
The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2012-4386US | medium6.8 | — | ||
The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-sit… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://struts.apache.org/2.x/docs/s2-010.htmlWEB
- http://www.openwall.com/lists/oss-security/2012/09/01/4WEB
- http://www.openwall.com/lists/oss-security/2012/09/01/5WEB
- https://exchange.xforce.ibmcloud.com/vulnerabilities/78182WEB
- https://issues.apache.org/jira/browse/WW-3858WEB
- https://nvd.nist.gov/vuln/detail/CVE-2012-4386ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan