PT-2015-5461 · Apache · Apache Struts

Jasper Rosenberg · Publicado 2015-07-16 · Atualizado 2022-05-17 · CVE-2015-1831

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Struts version 2.3.20

Description The default exclude patterns in Apache Struts allow remote attackers to compromise the internal state of an application via unspecified vectors.

Recommendations For Apache Struts version 2.3.20, consider updating to version 2.3.20.1, which includes a better set of exclude patterns to mitigate the issue.

Correção

Identificadores relacionados

CVE-2015-1831

GHSA-Q2CG-XF9P-H457

Produtos afetados

Apache Struts

Referências · 7

• https://github.com/apache/struts · Nota
• https://github.com/apache/struts/commit/d832747d647df343ed07a58b1b5e540a05a4d51b · Nota
• http://securitytracker.com/id/1032985 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1831 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-q2cg-xf9p-h457 · Aviso do Fabricante
• https://struts.apache.org/docs/s2-024.html · Aviso do Fabricante
• http://securityfocus.com/bid/75940 · Nota