Authorization Bypass Affecting org.apache.struts.xwork:xwork-core Open this link in a new tab package, versions [2,2.3.1.2)
Exploit Maturity
Mature
Attack Complexity
Low
Confidentiality
High
Integrity
High
Availability
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-JAVA-ORGAPACHESTRUTSXWORK-30787
-
published
19 Oct 2015
-
disclosed
19 Oct 2015
-
credit
Meder Kydyraliev
Introduced: 19 Oct 2015
CVE-2011-3923 Open this link in a new tabOverview
org.apache.struts.xwork:xwork-core
Affected versions of the package are vulnerable to Arbitrary Command Execution. A malicious user may bypass all the protections (regex pattern, deny method invocation) built into the ParametersInterceptor, thus being able to inject a malicious expression in any exposed string variable for further evaluation.