Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1jdnZ4LXIzM20tdjdwcc4AAWr1
Improper Input Validation in Apache Struts
The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.
Permalink: https://github.com/advisories/GHSA-cvvx-r33m-v7pqJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jdnZ4LXIzM20tdjdwcc4AAWr1
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: over 1 year ago
CVSS Score: 7.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Identifiers: GHSA-cvvx-r33m-v7pq, CVE-2015-0899
References:
- https://nvd.nist.gov/vuln/detail/CVE-2015-0899
- https://en.osdn.jp/projects/terasoluna/wiki/StrutsPatch2-EN
- https://security.netapp.com/advisory/ntap-20180629-0006/
- http://jvn.jp/en/jp/JVN86448949/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2015-000042
- http://www.debian.org/security/2016/dsa-3536
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- https://github.com/advisories/GHSA-cvvx-r33m-v7pq
Affected Packages
maven:org.apache.struts:struts-core
Dependent packages: 84Dependent repositories: 632
Downloads:
Affected Version Ranges: >= 1.1, <= 1.3.10
No known fixed version
All affected versions: 1.3.5, 1.3.8, 1.3.9, 1.3.10