Authorization Bypass Affecting org.apache.struts.xwork:xwork-core package, versions [2,2.3.1.2)
Threat Intelligence
Exploit Maturity
Mature
EPSS
95.19% (100th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHESTRUTSXWORK-30787
- published 19 Oct 2015
- disclosed 19 Oct 2015
- credit Meder Kydyraliev
Introduced: 19 Oct 2015
CVE-2011-3923 Open this link in a new tabOverview
org.apache.struts.xwork:xwork-core
Affected versions of the package are vulnerable to Arbitrary Command Execution. A malicious user may bypass all the protections (regex pattern, deny method invocation) built into the ParametersInterceptor, thus being able to inject a malicious expression in any exposed string variable for further evaluation.
References
CVSS Scores
version 3.1