org.apache.struts.xwork:xwork-core@2.2.1.1 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.apache.struts.xwork:xwork-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Improper Input Validation

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Improper Input Validation such that the TextParseUtil.translateVariables method allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.

Note:

The Struts 2 framework does not pass any user-modifiable input to this method, neither directly nor indirectly. However, a developer crafting a Struts based web application might pass unsanitized user input to TextParseUtil.translateVariables or ActionSupport's getText methods. In that case a RCE exploitation might be possible.

How to fix Improper Input Validation?

Upgrade org.apache.struts.xwork:xwork-core to version 2.3.24.1 or higher.

[2.0.0,2.3.24.1)
  • H
Arbitrary Code Execution

org.apache.struts.xwork:xwork-core Affected versions of the package are vulnerable to Remote code Execution. The Apache Struts frameworks when forced, performs double evaluation of attributes' values assigned to certain tags so it is possible to pass in a value that will be evaluated again when a tag's attributes will be rendered.

[2.2.1,2.3.28.1]
  • M
Improper Input Validation

org.apache.struts.xwork:xwork-core Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.

[2,2.3.24.1]
  • H
Command Injection

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Command Injection. When Dynamic Method Invocation was enabled, a remote attackers could execute arbitrary code via the prefix method, related to chained expressions.

How to fix Command Injection?

Upgrade org.apache.struts.xwork:xwork-core to version 2.3.20.2, 2.3.24.2, 2.3.28.1 or higher.

[2.0.0,2.3.20.2) [2.3.24,2.3.24.2) [2.3.28,2.3.28.1)
  • M
Cross-site Scripting (XSS)

org.apache.struts.xwork:xwork-core Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.

[2,2.3.25)
  • H
Improper Input Validation

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Improper Input Validation via a %{} sequence in a tag attribute, aka forced double OGNL evaluation.

How to fix Improper Input Validation?

Upgrade org.apache.struts.xwork:xwork-core to version 2.3.28 or higher.

[2,2.3.28)
  • C
Authorization Bypass

org.apache.struts.xwork:xwork-core Affected versions of the package are vulnerable to Arbitrary Command Execution. A malicious user may bypass all the protections (regex pattern, deny method invocation) built into the ParametersInterceptor, thus being able to inject a malicious expression in any exposed string variable for further evaluation.

[2,2.3.1.2)
  • H
Parameter Alteration

org.apache.struts.xwork:xwork-core Affected versions of the package are vulnerable to Parameter Alteration. ValueStack defines special top object which represents root of execution context. It can be used to manipulate Struts' internals or can be used to affect container's settings

[2,2.3.24.1)
  • H
Improper Input Validation

org.apache.struts.xwork:xwork-core The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

[2.0.0,2.2.3.1)
  • M
Arbitrary Fie Overwrite

org.apache.struts.xwork:xwork-core The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.

[2,2.3.1.1)
  • H
Arbitrary Command Execution

org.apache.struts.xwork:xwork-core The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

[2,2.3.1.1)
  • M
Arbitrary Code Execution

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Arbitrary Code Execution. ** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."

How to fix Arbitrary Code Execution?

Upgrade org.apache.struts.xwork:xwork-core to version 2.3.1.1 or higher.

[2.1.0,2.3.1.1)
  • C
Improper Input Validation

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Improper Input Validation. It evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.

How to fix Improper Input Validation?

Upgrade org.apache.struts.xwork:xwork-core to version 2.2.3.1 or higher.

[2.0.0,2.2.3.1)
  • H
Arbitrary Code Execution

org.apache.struts.xwork:xwork-core Apache Struts 2 before 2.3.14.1 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.

[2,2.3.14.1)
  • H
Arbitrary Code Execution

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Arbitrary Code Execution. It allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.

How to fix Arbitrary Code Execution?

Upgrade org.apache.struts.xwork:xwork-core to version 2.3.14.3 or higher.

[2.0.0,2.3.14.3)
  • H
Arbitrary Code Execution

org.apache.struts.xwork:xwork-core ParametersInterceptor in Apache Struts before 2.3.16.2 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

[2.0.0,2.3.16.2)
  • M
Denial of Service (DoS)

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Denial of Service (DoS). It allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.

How to fix Denial of Service (DoS)?

Upgrade org.apache.struts.xwork:xwork-core to version 2.3.4.1 or higher.

[2.0.0,2.3.4.1)
  • L
Cross-site Scripting (XSS)

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to multiple Cross-site Scripting (XSS) vulnerabilities allowing remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.

How to fix Cross-site Scripting (XSS)?

Upgrade org.apache.struts.xwork:xwork-core to version 2.2.3 or higher.

[2.0.0,2.2.3)
  • H
Arbitrary Code Injection

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Arbitrary Code Injection. It allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.

How to fix Arbitrary Code Injection?

Upgrade org.apache.struts.xwork:xwork-core to version 2.3.14.1 or higher.

[2.0.0,2.3.14.1)