PT-2015-3441 · Apache · Apache Struts
Takayoshi Isayama
·
Published
2015-08-13
·
Updated
2022-05-24
·
CVE-2015-2992
CVSS v2.0
6.4
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Struts versions prior to 2.3.20
Description
The issue is related to a cross-site scripting (XSS) vulnerability in the implementation of the debug mode (devMode) in Apache Struts. This vulnerability can be exploited by a remote attacker to conduct inter-site script attacks. When the Struts2 debug mode is turned on, under certain conditions, an arbitrary script may be executed in the 'Problem Report' screen. Additionally, if JSP files are exposed to be accessed directly, it's possible to execute an arbitrary script.
Recommendations
For versions prior to 2.3.20, turn off the debug mode in production setup to mitigate the risk.
Always hide JSP files inside the WEB-INF folder or define dedicated security constraints to block access to raw JSP files.
Consider upgrading to Struts 2.3.20 or higher if turning off debug mode is not possible.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Struts