logo

Database

Lack of data validation In org.apache.struts:struts-core

Description

Improper Input Validation in Apache Struts The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version

Aliases

1. CVE-2015-08992. NVD-2015-08993. OSV-2015-08994. GCVE-2015-0899

References

1. https://en.osdn.jp/projects/terasoluna/wiki/StrutsPatch2-EN2. https://security.netapp.com/advisory/ntap-20180629-00063. http://jvn.jp/en/jp/JVN86448949/index.html4. http://jvndb.jvn.jp/jvndb/JVNDB-2015-0000425. http://www.debian.org/security/2016/dsa-35366. http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.