[MAVEN:GHSA-X5X7-3V85-WPC4] Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used

Severity High

Affected Packages 2

Fixed Packages 2

CVEs 1

In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.

Package	Affected Version
pkg:maven/org.apache.struts/struts2-core	>= 2.5.0, <= 2.5.12
pkg:maven/org.apache.struts/struts2-core	>= 2.3.7, <= 2.3.33

Package	Fixed Version
pkg:maven/org.apache.struts/struts2-core	= 2.5.13
pkg:maven/org.apache.struts/struts2-core	= 2.3.34

ID

MAVEN:GHSA-X5X7-3V85-WPC4

Severity

high

URL

https://github.com/advisories/GHSA-x5x7-3v85-wpc4

Published

2018-10-16T19:37:33
(6 years ago)

Modified

2024-01-04T23:26:49
(8 months ago)

Rights

Maven Security Team

Other Advisories

CISCO-SA-20170907-STRUTS2

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2017-9804
			https://security.netapp.com/advisory/ntap-20180629-0001/
			https://struts.apache.org/docs/s2-050.html
			https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2
			http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt
			http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
			https://github.com/apache/struts/commit/418a20c0594f23764fe29ced400c1219239899a
			https://web.archive.org/web/20171113165852/http://www.securityfocus.com/bid/100612
			https://web.archive.org/web/20201021075553/http://www.securitytracker.com/id/1039261
			https://github.com/advisories/GHSA-x5x7-3v85-wpc4

Type	Package URL	Namespace	Name / Product	Version
Affected	pkg:maven/org.apache.struts/struts2-core	org.apache.struts	struts2-core	>= 2.5.0 <= 2.5.12
Fixed	pkg:maven/org.apache.struts/struts2-core	org.apache.struts	struts2-core	= 2.5.13
Affected	pkg:maven/org.apache.struts/struts2-core	org.apache.struts	struts2-core	>= 2.3.7 <= 2.3.33
Fixed	pkg:maven/org.apache.struts/struts2-core	org.apache.struts	struts2-core	= 2.3.34

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date