Apache Struts Improper Input Validation Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/03/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.struts:struts2-core | < 2.3.15.1 | 2.3.15.1 |
| archiva | = 1.2= 1.2.2≥ 1.3, < 1.3.8 | 1.3.8 |
| struts | ≥ 2.0.0, ≤ 2.3.15 | |
| interstage business process manager analytics | = 12.0= 12.1 | |
| siebel apps - e-billing | = 6.1= 6.1.1= 6.2 |
The Struts 2 DefaultActionMapper supports a method for short-circuit navigation state changes by prefixing parameters with "action:" or "redirect:", followed by a desired navigational target expression. This mechanism was intended to help with attaching navigational information to buttons within forms.
In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free