[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] [ANN] CVE-2018-11776 Apache Struts 2.3 to 2.3.34 and 2.5 to 2.5.16
From:       Yasser Zamani <yasserzamani () apache ! org>
Date:       2018-08-22 7:37:24
Message-ID: DB5PR08MB10623BF00ACDCA92BF685C63AF300 () DB5PR08MB1062 ! eurprd08 ! prod ! outlook ! com
[Download RAW message or body]

[CVEID]:CVE-2018-11776
[PRODUCT]:Apache Struts
[VERSION]:Apache Struts 2.3 to 2.3.34 and 2.5 to 2.5.16
[PROBLEMTYPE]:Remote Code Execution
[REFERENCES]:https://cwiki.apache.org/confluence/display/WW/S2-057
[DESCRIPTION]:Man Yue Mo from the Semmle Security Research team was
noticed that Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16
suffer from possible Remote Code Execution when using results with no
namespace and in same time, its upper action(s) have no or wildcard
namespace. Same possibility when using url tag which doesn't have value
and action set and in same time, its upper action(s) have no or wildcard
namespace.

[prev in list] [next in list] [prev in thread] [next in thread]