org.apache.struts.xwork:xwork-core@2.2.1.1 vulnerabilities
-
latest version
2.3.37
-
latest non vulnerable version
-
first published
14 years ago
-
latest version published
5 years ago
-
licenses detected
- [2.2.1,)
-
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.apache.struts.xwork:xwork-core package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.Vulnerability | Vulnerable Version |
---|---|
org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2. Affected versions of this package are vulnerable to Improper Input Validation such that the Note: The Struts 2 framework does not pass any user-modifiable input to this method, neither directly nor indirectly. However, a developer crafting a Struts based web application might pass unsanitized user input to How to fix Improper Input Validation? Upgrade |
[2.0.0,2.3.24.1)
|
|
[2.2.1,2.3.28.1]
|
|
[2,2.3.24.1]
|
org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2. Affected versions of this package are vulnerable to Command Injection. When Dynamic Method Invocation was enabled, a remote attackers could execute arbitrary code via the prefix method, related to chained expressions. How to fix Command Injection? Upgrade |
[2.0.0,2.3.20.2)
[2.3.24,2.3.24.2)
[2.3.28,2.3.28.1)
|
|
[2,2.3.25)
|
org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2. Affected versions of this package are vulnerable to Improper Input Validation via a How to fix Improper Input Validation? Upgrade |
[2,2.3.28)
|
|
[2,2.3.1.2)
|
|
[2,2.3.24.1)
|
|
[2.0.0,2.2.3.1)
|
|
[2,2.3.1.1)
|
|
[2,2.3.1.1)
|
org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2. Affected versions of this package are vulnerable to Arbitrary Code Execution. ** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself." How to fix Arbitrary Code Execution? Upgrade |
[2.1.0,2.3.1.1)
|
org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2. Affected versions of this package are vulnerable to Improper Input Validation. It evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field. How to fix Improper Input Validation? Upgrade |
[2.0.0,2.2.3.1)
|
|
[2,2.3.14.1)
|
org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2. Affected versions of this package are vulnerable to Arbitrary Code Execution. It allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice. How to fix Arbitrary Code Execution? Upgrade |
[2.0.0,2.3.14.3)
|
|
[2.0.0,2.3.16.2)
|
org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2. Affected versions of this package are vulnerable to Denial of Service (DoS). It allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression. How to fix Denial of Service (DoS)? Upgrade |
[2.0.0,2.3.4.1)
|
org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2. Affected versions of this package are vulnerable to multiple Cross-site Scripting (XSS) vulnerabilities allowing remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an How to fix Cross-site Scripting (XSS)? Upgrade |
[2.0.0,2.2.3)
|
org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2. Affected versions of this package are vulnerable to Arbitrary Code Injection. It allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect. How to fix Arbitrary Code Injection? Upgrade |
[2.0.0,2.3.14.1)
|