Description
A Remote Code Execution vulnerability exists in Apache Struts2 Showcase app in the Struts 1 plugin example in the Struts 2.3.x series.
Remediation
Always use resource keys instead of passing a raw message to the ActionMessage as shown below, never pass a raw value directly messages.add("msg", new ActionMessage("struts1.gangsterAdded", gform.getName())); and never like this messages.add("msg", new ActionMessage("Gangster " + gform.getName() + " was added"));