Description
The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | libstruts1.2-java | 1.2.9-5+deb7u2 | DSA-3536-1 |
| Debian 6.0 | libstruts1.2-java | 1.2.9-4+deb6u2 | DLA-292-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.struts:struts-core | >= 1.1, <= 1.3.10 | — | GHSA-cvvx-r33m-v7pq |
| Maven | struts:struts | >= 1.1, <= 1.2.9 | — | GHSA-cvvx-r33m-v7pq |
Advisories 4
- WID-SEC-2026-2751 IBM InfoSphere Guardium: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- DSA-3536-1 libstruts1.2-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-292-1 libstruts1.2-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2023-1594 IBM Tivoli Network Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 28, 2023
References
- https://security.netapp.com/advisory/ntap-20180629-0006/
- JVNDB-2015-000042 third-party-advisory
- JVN#86448949 third-party-advisory
- DSA-3536 vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- https://en.osdn.jp/projects/terasoluna/wiki/StrutsPatch2-EN
- 74423 vdb-entry