Apache Struts 1 Improper Input Validation Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 10/02/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.struts:struts2-struts1-plugin | ≤ 2.3.37 | |
| struts | = 2.3.1= 2.3.1.1= 2.3.1.2= 2.3.12= 2.3.14= 2.3.14.1= 2.3.14.2= 2.3.14.3= 2.3.15= 2.3.15.1= 2.3.15.2= 2.3.15.3= 2.3.16= 2.3.16.1= 2.3.16.2= 2.3.16.3= 2.3.20= 2.3.20.1= 2.3.20.3= 2.3.24= 2.3.24.1= 2.3.24.3= 2.3.28= 2.3.28.1= 2.3.29= 2.3.3= 2.3.30= 2.3.31= 2.3.32= 2.3.4= 2.3.4.1= 2.3.7= 2.3.8 |
The Struts 1 plugin used with Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free