| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.struts:struts2-convention-plugin | ≥ 2.3.0, < 2.3.31≥ 2.5.0, < 2.5.5 | 2.3.312.5.5 |
| struts | = 2.3.20= 2.3.20.1= 2.3.20.2= 2.3.20.3= 2.3.21= 2.3.22= 2.3.23= 2.3.24= 2.3.24.1= 2.3.24.2= 2.3.24.3= 2.3.25= 2.3.26= 2.3.27= 2.3.28= 2.3.28.1= 2.3.29= 2.3.30 |
In Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side. This vulnerability is only exploitable when using the Struts 2 Convention plugin in conjunction with Apache Struts.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free