Homepage
About Snyk

org.apache.struts.xwork:xwork-core@2.3.14.3 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.apache.struts.xwork:xwork-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Arbitrary Code Execution

org.apache.struts.xwork:xwork-core Affected versions of the package are vulnerable to Remote code Execution. The Apache Struts frameworks when forced, performs double evaluation of attributes' values assigned to certain tags so it is possible to pass in a value that will be evaluated again when a tag's attributes will be rendered.

[2.2.1,2.3.28.1]
  • M
Improper Input Validation

org.apache.struts.xwork:xwork-core Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.

[2,2.3.24.1]
  • H
Command Injection

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Command Injection. When Dynamic Method Invocation was enabled, a remote attackers could execute arbitrary code via the prefix method, related to chained expressions.

How to fix Command Injection?

Upgrade org.apache.struts.xwork:xwork-core to version 2.3.20.2, 2.3.24.2, 2.3.28.1 or higher.

[2.0.0,2.3.20.2) [2.3.24,2.3.24.2) [2.3.28,2.3.28.1)
  • M
Cross-site Scripting (XSS)

org.apache.struts.xwork:xwork-core Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.

[2,2.3.25)
  • H
Improper Input Validation

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Improper Input Validation via a %{} sequence in a tag attribute, aka forced double OGNL evaluation.

How to fix Improper Input Validation?

Upgrade org.apache.struts.xwork:xwork-core to version 2.3.28 or higher.

[2,2.3.28)
  • H
Parameter Alteration

org.apache.struts.xwork:xwork-core Affected versions of the package are vulnerable to Parameter Alteration. ValueStack defines special top object which represents root of execution context. It can be used to manipulate Struts' internals or can be used to affect container's settings

[2,2.3.24.1)
  • H
Arbitrary Code Execution

org.apache.struts.xwork:xwork-core ParametersInterceptor in Apache Struts before 2.3.16.2 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

[2.0.0,2.3.16.2)
Go back to all versions of this package