Homepage
About Snyk

org.apache.struts.xwork:xwork-core@2.3.20 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.apache.struts.xwork:xwork-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Improper Input Validation

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Improper Input Validation such that the TextParseUtil.translateVariables method allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.

Note:

The Struts 2 framework does not pass any user-modifiable input to this method, neither directly nor indirectly. However, a developer crafting a Struts based web application might pass unsanitized user input to TextParseUtil.translateVariables or ActionSupport's getText methods. In that case a RCE exploitation might be possible.

How to fix Improper Input Validation?

Upgrade org.apache.struts.xwork:xwork-core to version 2.3.24.1 or higher.

[2.0.0,2.3.24.1)
  • H
Arbitrary Code Execution

org.apache.struts.xwork:xwork-core Affected versions of the package are vulnerable to Remote code Execution. The Apache Struts frameworks when forced, performs double evaluation of attributes' values assigned to certain tags so it is possible to pass in a value that will be evaluated again when a tag's attributes will be rendered.

[2.2.1,2.3.28.1]
  • H
Access Restriction Bypass

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Access Restriction Bypass. It allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.

[2.3.20,2.3.28.1]
  • M
Regular Expression Denial of Service (ReDoS)

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). The URLValidator class allows remote attackers to cause a denial of service via a null value for a URL field.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade org.apache.struts.xwork:xwork-core to version 2.3.29 or higher.

[2.3.20,2.3.29)
  • M
Improper Input Validation

org.apache.struts.xwork:xwork-core Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.

[2,2.3.24.1]
  • H
Command Injection

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Command Injection. When Dynamic Method Invocation was enabled, a remote attackers could execute arbitrary code via the prefix method, related to chained expressions.

How to fix Command Injection?

Upgrade org.apache.struts.xwork:xwork-core to version 2.3.20.2, 2.3.24.2, 2.3.28.1 or higher.

[2.0.0,2.3.20.2) [2.3.24,2.3.24.2) [2.3.28,2.3.28.1)
  • M
Cross-site Scripting (XSS)

org.apache.struts.xwork:xwork-core Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.

[2,2.3.25)
  • H
Improper Input Validation

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Improper Input Validation via a %{} sequence in a tag attribute, aka forced double OGNL evaluation.

How to fix Improper Input Validation?

Upgrade org.apache.struts.xwork:xwork-core to version 2.3.28 or higher.

[2,2.3.28)
  • H
Parameter Alteration

org.apache.struts.xwork:xwork-core Affected versions of the package are vulnerable to Parameter Alteration. ValueStack defines special top object which represents root of execution context. It can be used to manipulate Struts' internals or can be used to affect container's settings

[2,2.3.24.1)
  • H
Insecure Defaults

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Insecure Defaults. The default exclude patterns (excludeParams) allow remote attackers to "compromise internal state of an application" via unspecified vectors.

How to fix Insecure Defaults?

Upgrade org.apache.struts.xwork:xwork-core to version 2.3.20.1 or higher.

[2.3.20,2.3.20.1)
Go back to all versions of this package