PT-2012-1239 · Apache · Apache Struts

René Gielen · Publicado 2012-08-03 · Atualizado 2022-05-17 · CVE-2012-4386

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.3.4

Description The issue is related to the implementation of the token check mechanism in Apache Struts, which does not properly validate the token name configuration parameter. This allows remote attackers to perform cross-site request forgery (CSRF) attacks. The exploitation of this issue can enable an attacker to execute unauthorized requests.

Recommendations For Apache Struts versions 2.0.0 through 2.3.4, update to a version that properly validates the token name configuration parameter to prevent CSRF attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

BDU:2022-05908

CVE-2012-4386

GHSA-2RVH-Q539-Q33V

Produtos afetados

Apache Struts

Referências · 15

• https://ibm.com/blogs/psirt/security-bulletin-ibm-call-center-and-apache-struts-struts-upgrade-strategy-various-cves-see-below · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4386 · Nota
• http://xforce.iss.net/xforce/xfdb/7818 · Nota
• https://bdu.fstec.ru/vul/2022-05908 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78182 · Nota
• http://openwall.com/lists/oss-security/2012/09/01/4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4386 · Nota de Segurança
• http://securityfocus.com/bid/55346 · Nota
• https://openwall.com/lists/oss-security/2012/09/01/5 · Nota
• https://cwiki.apache.org/confluence/display/WW/S2-010 · Nota
• http://struts.apache.org/2.x/docs/s2-010.html · Aviso do Fabricante
• http://secunia.com/advisories/50420 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/09/01/5 · Nota
• https://issues.apache.org/jira/browse/WW-3858 · Nota
• https://osv.dev/vulnerability/GHSA-2rvh-q539-q33v · Aviso do Fabricante