Description
The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.struts:struts2-core | >= 2.0.0, < 2.3.4.1 | 2.3.4.1 | GHSA-2rvh-q539-q33v |
References
- https://issues.apache.org/jira/browse/WW-3858
- apache-struts-csrf(78182) vdb-entry
- [oss-security] 20120901 Re: CVE request: Apache Struts S2-010 and S2-011 mailing-list
- 50420 third-party-advisory
- 55346 vdb-entry
- http://struts.apache.org/2.x/docs/s2-010.html
- [oss-security] 20120901 CVE request: Apache Struts S2-010 and S2-011 mailing-list