| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.struts:struts2-core | ≥ 2.3.20, < 2.3.29≥ 2.5.0, < 2.5.13 | 2.3.292.5.13 |
| struts | = 2.3.20= 2.3.20.1= 2.3.20.3= 2.3.24= 2.3.24.1= 2.3.24.3= 2.3.28= 2.3.28.1= 2.5 |
The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.13 allows remote attackers to cause a denial of service via a null value for a URL field.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free