<p>Upgrade <code>org.apache.struts.xwork:xwork-core</code> to version 2.3.20.1 or higher.</p>

Insecure Defaults Affecting org.apache.struts.xwork:xwork-core package, versions [2.3.20,2.3.20.1)

Snyk CVSS

Attack Complexity Low

Threat Intelligence

EPSS 1.19% (85^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-JAVA-ORGAPACHESTRUTSXWORK-474418
published 11 May 2015
disclosed 11 May 2015
credit Jasper Rosenberg

Report a new vulnerability Found a mistake?

Introduced: 11 May 2015

CVE-2015-1831 Open this link in a new tab CWE-453 Open this link in a new tab

How to fix?

Upgrade org.apache.struts.xwork:xwork-core to version 2.3.20.1 or higher.

Overview

org.apache.struts.xwork:xwork-core is a generic command pattern framework. It forms the core of Struts 2.

Affected versions of this package are vulnerable to Insecure Defaults. The default exclude patterns (excludeParams) allow remote attackers to "compromise internal state of an application" via unspecified vectors.