Versions Compared

Old Version 3

changes.mady.by.user Maurizio Cucchiara

Saved on

compared with

New Version Current

changes.mady.by.user Maurizio Cucchiara

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Migrated to Confluence 5.3

Summary

Excerpt

User input is evaluated as an OGNL expression when there's a conversion error

Who should read this

All Struts 2 developers

Impact of vulnerability

Remote Code Execution

Maximum security rating

Important

Recommendation

Developers should either upgrade to Struts 2.2.3.1 or apply the configuration changes described below

Affected Software

Struts 2.0.0 - Struts 2.2.3

Original JIRA Tickets

WW-3668

Reporter

Hideyuki Suzumi

CVE Identifier

-

Problem

User input is evaluated as an OGNL expression when there's a conversion error. This allows a malicious user to execute arbitrary code. 
A more detailed description is found in the referenced JIRA ticket.

Solution

Upgrade to Struts 2.2.3.1.