org.apache.struts.xwork:xwork-core@2.3.20.3 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.apache.struts.xwork:xwork-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Arbitrary Code Execution

org.apache.struts.xwork:xwork-core Affected versions of the package are vulnerable to Remote code Execution. The Apache Struts frameworks when forced, performs double evaluation of attributes' values assigned to certain tags so it is possible to pass in a value that will be evaluated again when a tag's attributes will be rendered.

[2.2.1,2.3.28.1]
  • H
Access Restriction Bypass

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Access Restriction Bypass. It allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.

[2.3.20,2.3.28.1]
  • M
Regular Expression Denial of Service (ReDoS)

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). The URLValidator class allows remote attackers to cause a denial of service via a null value for a URL field.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade org.apache.struts.xwork:xwork-core to version 2.3.29 or higher.

[2.3.20,2.3.29)
  • M
Improper Input Validation

org.apache.struts.xwork:xwork-core Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.

[2,2.3.24.1]
  • M
Cross-site Scripting (XSS)

org.apache.struts.xwork:xwork-core Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.

[2,2.3.25)
  • H
Improper Input Validation

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Improper Input Validation via a %{} sequence in a tag attribute, aka forced double OGNL evaluation.

How to fix Improper Input Validation?

Upgrade org.apache.struts.xwork:xwork-core to version 2.3.28 or higher.

[2,2.3.28)
  • H
Parameter Alteration

org.apache.struts.xwork:xwork-core Affected versions of the package are vulnerable to Parameter Alteration. ValueStack defines special top object which represents root of execution context. It can be used to manipulate Struts' internals or can be used to affect container's settings

[2,2.3.24.1)