| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.struts:struts2-core | ≥ 2.3.19, < 2.3.20.3≥ 2.3.21, < 2.3.24.3≥ 2.3.25, < 2.3.28.1 | 2.3.20.32.3.24.32.3.28.1 |
| struts | = 2.3.20= 2.3.20.1= 2.3.24= 2.3.24.1= 2.3.28 |
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free