PT-2006-2547 · Apache · Apache Struts

Paul Benedict

·

Publicado

2006-03-30

·

Atualizado

2023-02-13

·

CVE-2006-1546

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: Apache Software Foundation (ASF) Struts versions prior to 1.2.9
Description: The issue allows remote attackers to bypass validation by sending a request with a parameter org.apache.struts.taglib.html.Constants.CANCEL, causing the action to be canceled without being detected by applications that do not use the isCancelled check.
Recommendations: For versions prior to 1.2.9, update to version 1.2.9 or later to resolve the issue. As a temporary workaround, consider adding the isCancelled check in applications to detect canceled actions.

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2006-1546
GHSA-VF8G-MPMW-QV87

Produtos afetados

Apache Struts