PT-2015-5461 · Apache · Apache Struts

Jasper Rosenberg · Published 2015-07-16 · Updated 2022-05-17 · CVE-2015-1831

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Struts version 2.3.20

Description The default exclude patterns in Apache Struts allow remote attackers to compromise the internal state of an application via unspecified vectors.

Recommendations For Apache Struts version 2.3.20, consider updating to version 2.3.20.1, which includes a better set of exclude patterns to mitigate the issue.

Fix

Related Identifiers

CVE-2015-1831

GHSA-Q2CG-XF9P-H457

Affected Products

Apache Struts

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2015-1831 · Security Note
• https://osv.dev/vulnerability/GHSA-q2cg-xf9p-h457 · Vendor Advisory
• https://struts.apache.org/docs/s2-024.html · Vendor Advisory
• https://github.com/apache/struts · Note
• https://github.com/apache/struts/commit/d832747d647df343ed07a58b1b5e540a05a4d51b · Note
• http://securitytracker.com/id/1032985 · Note
• http://securityfocus.com/bid/75940 · Note