logo

Database

Lack of data validation In struts:struts

Description

Apache Struts vulnerable to Improper Input Validation Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2006-15462. NVD-2006-15463. OSV-2006-15464. GCVE-2006-1546

References

1. https://exchange.xforce.ibmcloud.com/vulnerabilities/256122. http://issues.apache.org/bugzilla/show_bug.cgi?id=383743. http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html4. http://mail-archives.apache.org/mod_mbox/struts-dev/200601.mbox/%[email protected]%3e5. http://mail-archives.apache.org/mod_mbox/struts-dev/200601.mbox/%3cdr169r%24623%242%40sea.gmane.org%3e6. http://mail-archives.apache.org/mod_mbox/struts-user/200601.mbox/%3c20060121221800.15814.qmail%40web32607.mail.mud.yahoo.com%3e7. http://mail-archives.apache.org/mod_mbox/struts-user/200601.mbox/%[email protected]%3e8. http://securitytracker.com/id?10158569. http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html10. http://www.securityfocus.com/bid/1734211. http://www.vupen.com/english/advisories/2006/1205

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.