Multiple critical vulnerabilities in Apache Struts2

Description

Apache Struts2 is a web framework for creating Java web applications. It is using the OpenSymphony XWork and OGNL libraries. By default, XWork's ParametersInterceptor treats parameter names provided to actions as OGNL expressions. A OGNL (Object Graph Navigation Language) expression is a limited language similar to Java that is tokenized and parsed by the OGNL parser which invokes appropriate Java methods. Under certain circumstances it's possible to send custom OGNL statements and execute malicious Java code.

Remediation

Upgrade to Struts version 2.3.1.1

References
Severity
Classification
Tags
  • Code Execution  Known Vulnerabilities