Description
Apache Struts2 is a web framework for creating Java web applications. It is using the OpenSymphony XWork and OGNL libraries. By default, XWork's ParametersInterceptor treats parameter names provided to actions as OGNL expressions. A OGNL (Object Graph Navigation Language) expression is a limited language similar to Java that is tokenized and parsed by the OGNL parser which invokes appropriate Java methods. Under certain circumstances it's possible to send custom OGNL statements and execute malicious Java code.
Remediation
Upgrade to Struts version 2.3.1.1
References
Multiple critical vulnerabilities in Apache Struts2
22 January 2011 - Struts 2.3.1.2 General Availability Release