Apache Struts 2 'action:' Parameter Prefix Security Constraint Bypass

The remote web application appears to use Struts 2, a web framework used for creating Java web applications. The version of Struts 2 in use is affected by a security constraint bypass vulnerability due to a flaw in the action mapping mechanism. Under certain unspecified conditions, an attacker...

Apache Struts 远程代码执行漏洞(CVE-2013-4316)

BUGTRAQ ID: 62587 CVECAN ID: CVE-2013-4316 Struts2 是第二代基于Model-View-Controller MVC模型的java企业级web应用框架。 Apache Struts 2.3.15.2之前版本的“Dynamic Method Invocation”机制是默认开启的，仅提醒用户如果可能的情况下关闭此机制，这样就存在远程代码执行漏洞，远程攻击者可利用此漏洞在受影响应用上下文中执行任意代码。 0 Apache Group Struts 2.3.15.2 厂商补丁： Apache Group ------------ Apache...

PT-2013-1360

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.3.15.1 Description The issue is related to the implementation of the Dynamic Method Invocation DMI mechanism in Apache Struts, which is associated with access control deficiencies. Exploitation of this...

PT-2011-3360

Name of the Vulnerable Software and Affected Versions Apache Struts versions prior to 2.2.3 OpenSymphony WebWork affected versions not specified Description The issue allows remote attackers to inject arbitrary web script or HTML via various vectors, including an action name, the action attribute...

Apache Struts XWork 's:submit' HTML标签跨站脚本漏洞

ugtraq ID: 47784 CVE ID：CVE-2011-1772 Apache Struts是一款建立Java web应用程序的开放源代码架构。 通过使用BASH语法的"s:submit"标签传递的Action或方法名，如果没有进行定义，在用于生成错误页面之前，XWork没有对其进行正确过滤。攻击者可以利用漏洞在目标用户浏览器上执行任意HTML和脚本代码。 成功利用漏洞需要启用Dynamic Method Invocation默认启用。 Apache Software Foundation Struts 2.2.1 1 Apache Software Foundation...

Apache Struts 2 Cross Site Scripting

Security Advisory: MVSA-11-006 CVE: CVE-2011-1772 Vendor: Apache Software Foundation Product: Struts 2 Framework Vulnerabilities: Multiple Reflected XSS in XWork error pages Risk: High Attack Vector: From Remote Authentication: Not Required References: -...

Apache Struts 2.0.0 2.2.1.1 - XWork s:submit HTML Tag Cross-Site Scripting

Apache Struts 2.0.0 2.2.1.1 - XWork s:submit HTML Tag Cross-Site Scripting source: https://www.securityfocus.com/bid/47784/info Apache Struts is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Successful exploitation requires 'Dynamic...