~ / search / GHSA-j7h6-xr7g-m2c5

GHSA-j7h6-xr7g-m2c5

Code injection in Apache Struts

Source: GitHub Advisory Database (reviewed) High CVE-2013-4316

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.struts:struts2-core >= 2.0.0, < 2.3.15.2 2.3.15.2
Maven org.apache.struts:struts2-rest-plugin >= 2.0.0, < 2.3.15.2 2.3.15.2

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.

References

External links from the advisory. They lead to third-party sites.