Apache Struts is an open-source web application framework for developing Java EE web applications. The Struts 1 plugin allows developers to use Struts 1 Actions and ActionForms in Struts 2 applications. The Showcase application is an example application in the Struts 1 plugin.
The Showcase application in the Struts 1 plugin allows a remote attacker to inject commands within OGNL code, resulting in arbitrary command execution.
Remove the Struts 1 plugin and/or the Showcase example application if it is not needed.
Always use resource keys instead of passing a raw messages to the ActionMessage. Never pass a raw value directly.