Arbitrary code execution in Apache Struts 2

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2013-2134 · ADVISORY
• apache/struts commit 01e6b25 · WEB
• apache/struts commit 041206d · WEB
• apache/struts commit 113c470 · WEB
• apache/struts commit 54e5c91 · WEB
• apache/struts commit 711cf02 · WEB
• apache/struts commit 8b4fc81 · WEB
• apache/struts commit cfb6e9a · WEB
• cwiki.apache.org/confluence/display/WW/S2-015 · WEB
• apache/struts · PACKAGE
• issues.apache.org/jira/browse/WW-4090 · WEB

Lỗ hổng khác của org.apache.struts.xwork:xwork-core

• CVE-2025-68493CAO 8.1Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Str…
• CVE-2016-4433CAO 7.5Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a…
• CVE-2016-4430CAO 8.8Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CS…
• CVE-2015-1831CAO 7.5The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application"…
• CVE-2014-0094TRUNG BÌNH 5.0The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, …