Denial of service in Apache Struts
Moderate severity
GitHub Reviewed
Published
May 17, 2022
to the GitHub Advisory Database
•
Updated Dec 27, 2023
Package
Affected versions
>= 2.0.0, < 2.3.4.1
Patched versions
2.3.4.1
Description
Published by the National Vulnerability Database
Sep 5, 2012
Published to the GitHub Advisory Database
May 17, 2022
Reviewed
Nov 3, 2022
Last updated
Dec 27, 2023
Credits
-
sunSUNQ Analyst
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
References