logo

Database

Lack of data validation In org.apache.struts:struts2-core

Description

Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2017-98042. NVD-2017-98043. OSV-2017-98044. GCVE-2017-9804

References

1. https://github.com/apache/struts/commit/418a20c0594f23764fe29ced400c1219239899a2. https://security.netapp.com/advisory/ntap-20180629-00013. https://struts.apache.org/docs/s2-050.html4. https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts25. https://web.archive.org/web/20171113165852/http://www.securityfocus.com/bid/1006126. https://web.archive.org/web/20201021075553/http://www.securitytracker.com/id/10392617. http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt8. http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.