Description
A Remote Code Execution vulnerability exists in Apache Struts2 Showcase app in the Struts 1 plugin example in the Struts 2.3.x series.
Remediation
Always use resource keys instead of passing a raw message to the ActionMessage as shown below, never pass a raw value directly messages.add("msg", new ActionMessage("struts1.gangsterAdded", gform.getName())); and never like this messages.add("msg", new ActionMessage("Gangster " + gform.getName() + " was added"));
References
Related Vulnerabilities
Roundcube Cross-site Scripting (XSS) Vulnerability (CVE-2015-1433)
Bonita Authorization Bypass (CVE-2022-25237)
Oracle Database Server CVE-2009-1985 Vulnerability (CVE-2009-1985)
WebLogic CVE-2016-5531 Vulnerability (CVE-2016-5531)
Jboss EAP Improper Restriction of XML External Entity Reference Vulnerability (CVE-2017-7464)