Description

Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable values, which allows remote attackers to bypass the CSRF protection mechanism.

Remediation

References

Related Vulnerabilities

Severity

Critical

Tags

Vendor Advisory CWE-352