Description

Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.

Remediation

References

http://struts.apache.org/development/2.x/docs/s2-012.html

http://www.securityfocus.com/bid/60082

https://bugzilla.redhat.com/show_bug.cgi?id=967655

Related Vulnerabilities

CVE-2022-42123 Vulnerability in maven package com.liferay:com.liferay.portal.search.elasticsearch7.impl

CVE-2021-37137 Vulnerability in maven package io.netty:netty-codec

CVE-2017-5662 Vulnerability in maven package org.apache.xmlgraphics:batik-dom

CVE-2021-41164 Vulnerability in maven package org.webjars.bowergithub.ckeditor:ckeditor4

CVE-2022-31129 Vulnerability in maven package org.webjars.bowergithub.moment:moment

Severity

Critical

Classification

CWE-94

Tags

Vendor Advisory Third Party Advisory VDB Entry