PT-2013-1358 · Apache · Apache Struts
Zhang Jin
+1
·
Published
2013-09-30
·
Updated
2022-05-17
·
CVE-2013-4310
CVSS v2.0
5.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Struts versions 2.0.0 through 2.3.15.1
Description
The issue is related to the implementation of the DefaultActionMapper mechanism in Apache Struts, which has weaknesses in access control when handling the
action: prefix parameter. This can allow a remote attacker to bypass security constraints. The action: prefix is intended for attaching navigational information to buttons within forms, but under certain conditions, it can be exploited to bypass security constraints.Recommendations
For Apache Struts versions 2.0.0 through 2.3.15.1, consider updating to version 2.3.15.3 or later, where the action mapping mechanism was changed to avoid circumventing security constraints.
As a temporary workaround, consider setting the
struts.mapper.action.prefix.enabled constant to false to disable support for the action: prefix, and set the struts.mapper.action.prefix.crossNamespaces constant to false to require actions defined with the action: prefix to be in the same namespace as the current action.Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Apache Struts