PT-2025-31399 · Apache · Apache Struts Extras

Ryan Murphy · Published 2025-07-30 · Updated 2025-08-06 · CVE-2025-54656

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Struts Extras versions prior to 2

Description This issue involves improper output neutralization for logs in Apache Struts Extras. When using LookupDispatchAction, untrusted input may be printed to logs without filtering. This can lead to log output where part of the message appears as a separate log line, potentially confusing log consumers. The project is retired and will not receive a fix for this issue.

Recommendations Users are recommended to find an alternative or restrict access to the instance to trusted users.

Fix

Weakness Enumeration

CWE-117

Related Identifiers

CVE-2025-54656

GHSA-CX25-XG7C-XFM5

Affected Products

Apache Struts Extras

References · 10

• https://osv.dev/vulnerability/CVE-2025-54656 · Vendor Advisory
• https://lists.apache.org/thread/so5cn07j2zn9vlf1xnfqp630wts719rr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54656 · Security Note
• https://osv.dev/vulnerability/GHSA-cx25-xg7c-xfm5 · Vendor Advisory
• https://github.com/apache/struts · Note
• http://openwall.com/lists/oss-security/2025/07/30/1 · Note
• https://twitter.com/oss_security/status/1950579381815963741 · Twitter Post
• https://twitter.com/CVEnew/status/1950594000479740083 · Twitter Post
• https://t.me/CVEtracker/28757 · Telegram Post
• https://t.me/cveNotify/131069 · Telegram Post