logo

Database

Cross-site request forgery In org.apache.struts:struts2-core

Description

Cross-Site Request Forgery in Apache Struts The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2012-43862. NVD-2012-43863. OSV-2012-43864. GCVE-2012-4386

References

1. https://exchange.xforce.ibmcloud.com/vulnerabilities/781822. https://issues.apache.org/jira/browse/WW-38583. http://struts.apache.org/2.x/docs/s2-010.html4. http://www.openwall.com/lists/oss-security/2012/09/01/45. http://www.openwall.com/lists/oss-security/2012/09/01/5

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.