Description
** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts.
This issue affects Apache Struts Extras: before 2.
When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output where part of the message masquerades as a separate log line, confusing consumers of the logs (either human or automated).
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Struts Extras | < 2 | 2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.struts:struts-extras | <= 1.3.10 | — | GHSA-cx25-xg7c-xfm5 |
| Maven | struts:struts | 1.2.9 | — | GHSA-cx25-xg7c-xfm5 |
Advisories 1
- WID-SEC-2025-1691 Apache Struts: Schwachstelle ermöglicht Manipulation BSI CERT-Bund (WID) · Jul 30, 2025
References
- https://lists.apache.org/thread/so5cn07j2zn9vlf1xnfqp630wts719rr vendor-advisory