Description

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.

Remediation

References

http://www.securityfocus.com/bid/60166

http://struts.apache.org/development/2.x/docs/s2-013.html

https://cwiki.apache.org/confluence/display/WW/S2-013

https://bugzilla.redhat.com/show_bug.cgi?id=967656

Related Vulnerabilities

CVE-2021-39177 Vulnerability in maven package org.geysermc:connector

CVE-2020-7677 Vulnerability in maven package org.webjars.npm:thenify

CVE-2020-28472 Vulnerability in npm package @aws-sdk/shared-ini-file-loader

CVE-2021-32729 Vulnerability in maven package org.xwiki.platform:xwiki-platform-security-authentication-script

CVE-2020-9483 Vulnerability in maven package org.apache.skywalking:server-storage-plugin

Severity

Critical

Classification

CWE-94

Tags

Third Party Advisory VDB Entry Vendor Advisory