Description
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- apache / Struts2.0.0 – 2.3.37
- Apache Software Foundation / Apache Struts2.0.0 – 2.3.37
- Apache Software Foundation / Apache Struts2.5.0 – 2.5.33
- Apache Software Foundation / Apache Struts6.0.0 – 6.11.0
- Apache Software Foundation / Apache Struts7.0.0 – 7.3.0
References
Updated 20m ago · 8 sources