[MAVEN:GHSA-5GGR-MPGW-3MGX] Improper Input Validation in Apache Struts

Severity High

Affected Packages 1

CVEs 1

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

Package	Affected Version
pkg:maven/org.apache.struts/struts-core	<= 1.3.10

ID

MAVEN:GHSA-5GGR-MPGW-3MGX

Severity

high

URL

https://github.com/advisories/GHSA-5ggr-mpgw-3mgx

Published

2022-05-13T01:25:19
(2 years ago)

Modified

2023-01-27T05:02:32
(20 months ago)

Rights

Maven Security Team

Other Advisories

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2016-1182
			https://github.com/kawasima/struts1-forever/commit/eda3a79907ed8fcb0387a0496d0cb14332f250e8
			https://bugzilla.redhat.com/show_bug.cgi?id=1343540
			https://security-tracker.debian.org/tracker/CVE-2016-1182
			https://security.netapp.com/advisory/ntap-20180629-0006/
			https://www.oracle.com/security-alerts/cpujan2020.html
			https://www.oracle.com/security-alerts/cpujul2020.html
			https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
			https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
			https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
			http://jvn.jp/en/jp/JVN65044642/index.html
			http://jvndb.jvn.jp/jvndb/JVNDB-2016-000097
			http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
			http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
			http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
			http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
			http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
			http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
			https://github.com/advisories/GHSA-5ggr-mpgw-3mgx

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:maven/org.apache.struts/struts-core	org.apache.struts	struts-core	<= 1.3.10

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date