Description
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.struts:struts2-core | >= 2.0.0, < 2.3.14.3 | 2.3.14.3 | GHSA-pw8r-x2qm-3h5m |
| Maven | org.apache.struts.xwork:xwork-core | >= 2.0.0, < 2.3.14.3 | 2.3.14.3 | GHSA-pw8r-x2qm-3h5m |