Description
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.
Remediation
References
http://www.securityfocus.com/bid/75940
http://www.securitytracker.com/id/1032985
https://struts.apache.org/docs/s2-024.html
Related Vulnerabilities
CVE-2018-1000609 Vulnerability in maven package io.jenkins:configuration-as-code
CVE-2015-2080 Vulnerability in maven package org.eclipse.jetty.aggregate:jetty-all
CVE-2011-4838 Vulnerability in maven package org.jruby:jruby-core
CVE-2022-36881 Vulnerability in maven package org.jenkins-ci.plugins:git-client
CVE-2019-3888 Vulnerability in maven package io.undertow:undertow-core