Apache Struts OGNL Expression Injection Vulnerability
Last Update Date:
29 May 2013
Release Date:
28 May 2013
4247
Views
RISK: Medium Risk
TYPE: Servers - Web Servers
A vulnerability has been identified in Apache Struts, which can be exploited by malicious people to bypass certain security restrictions.
The vulnerability is caused due to an error when handling the "includeParams" attribute, which can be exploited to modify server-side objects and e.g. execute arbitrary commands via specially crafted OGNL (Object-Graph Navigation Language) expressions.
Impact
- Security Restriction Bypass
System / Technologies affected
- versions prior to 2.3.14.2
Solutions
Before installation of the software, please visit the software manufacturer web-site for more details.
- Update to version 2.3.14.2
Vulnerability Identifier
Source
Related Link
Share with