Skip to content

Incomplete exclude pattern in Apache Struts

High severity GitHub Reviewed Published May 17, 2022 to the GitHub Advisory Database • Updated Dec 28, 2023

Package

maven org.apache.struts.xwork:xwork-core (Maven)

Affected versions

>= 2.0.0, < 2.3.20.1

Patched versions

2.3.20.1
maven org.apache.struts:struts2-core (Maven)
>= 2.0.0, < 2.3.20.1
2.3.20.1

Description

The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. In Struts 2.3.20.1 a better set of exlude patterns was defined.

References

Published by the National Vulnerability Database Jul 16, 2015
Published to the GitHub Advisory Database May 17, 2022
Reviewed Nov 3, 2022
Last updated Dec 28, 2023

Severity

High

EPSS score

1.276%
(85th percentile)

Weaknesses

No CWEs

CVE ID

CVE-2015-1831

GHSA ID

GHSA-q2cg-xf9p-h457

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.