logo

Database

Lack of data validation In org.apache.struts:struts-parent

Description

Apache Struts Access Control Redirect Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2016-44312. NVD-2016-44313. OSV-2016-44314. GHSA-vq79-mgpx-2wx45. GCVE-2016-4431

References

1. https://github.com/apache/struts/commit/eccc31ebce5430f9e91b9684c63eaaf885e603f92. https://bugzilla.redhat.com/show_bug.cgi?id=13482523. https://struts.apache.org/docs/s2-040.html4. https://web.archive.org/web/20210123145002/http://www.securityfocus.com/bid/912845. http://jvn.jp/en/jp/JVN45093481/index.html6. http://jvndb.jvn.jp/jvndb/JVNDB-2016-0001137. http://www-01.ibm.com/support/docview.wss?uid=ssg1S10092828. http://www-01.ibm.com/support/docview.wss?uid=swg219878549. http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.