Description
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.struts:struts2-core | >= 2.0.0, < 2.3.20.1 | 2.3.20.1 | GHSA-q2cg-xf9p-h457 |
| Maven | org.apache.struts.xwork:xwork-core | >= 2.0.0, < 2.3.20.1 | 2.3.20.1 | GHSA-q2cg-xf9p-h457 |
References
- https://struts.apache.org/docs/s2-024.html
- 75940 vdb-entry
- 1032985 vdb-entry