Improper Input Validation Affecting org.apache.struts:struts2-core Open this link in a new tab package, versions [2.0.0, 184.108.40.206)
Do your applications use this vulnerable package?
17 Jun 2014
5 Aug 2011
How to fix?
org.apache.struts:struts2-core to version 220.127.116.11 or higher.
org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language.
Affected versions of this package are vulnerable to Improper Input Validation. It evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.