GHSA-vf8g-mpmw-qv87
Apache Struts vulnerable to Improper Input Validation
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | struts:struts | < 1.2.9 | 1.2.9 |
Details
As written in the advisory (Markdown source, shown as plain text).
Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2006-1546
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25612
- https://github.com/apache/struts
- http://issues.apache.org/bugzilla/show_bug.cgi?id=38374
- http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html
- http://mail-archives.apache.org/mod_mbox/struts-dev/200601.mbox/%[email protected]%3e
- http://mail-archives.apache.org/mod_mbox/struts-dev/200601.mbox/%3cdr169r%24623%242%40sea.gmane.org%3e
- http://mail-archives.apache.org/mod_mbox/struts-user/200601.mbox/%3c20060121221800.15814.qmail%40web32607.mail.mud.yahoo.com%3e
- http://mail-archives.apache.org/mod_mbox/struts-user/200601.mbox/%[email protected]%3e
- http://secunia.com/advisories/19493
- http://secunia.com/advisories/20117
- http://securitytracker.com/id?1015856
- http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html
- http://www.securityfocus.com/bid/17342
- http://www.vupen.com/english/advisories/2006/1205