com.amashchenko.struts2.actionflow:struts2-actionflow-plugin (2.4.0), com.amashchenko.struts2.actionflow:struts2-actionflow-showcase (2.4.0) +71 more potentially affected by CVE-2016-4430 via org.apache.struts.xwork:xwork-core (>=2.3.20, <=2.3.28.1)

org.apache.struts.xwork:xwork-core MAVEN version =2.3.20, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =2.0.1, =2.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.7 - com.weicoder:frame 1.1.0 and more Source cves: CVE-2016-4430 Source advisory: GHSA-38QW-J787-V8C2...

com.amashchenko.struts2.actionflow:struts2-actionflow-plugin (2.4.0), com.amashchenko.struts2.actionflow:struts2-actionflow-showcase (2.4.0) +71 more potentially affected by CVE-2016-4430 via org.apache.struts.xwork:xwork-core (>=2.3.20, <=2.3.28.1)

org.apache.struts.xwork:xwork-core MAVEN version =2.3.20, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =2.0.1, =2.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.7 - com.weicoder:frame 1.1.0 and more Source cves: CVE-2016-4430 Source advisory: OSV:GHSA-38QW-J787-V8C2...

CVE-2016-4430

CVE-2016-4430 affects Apache Struts 2.3.20–2.3.28.1, where token validation is mishandled, enabling remote CSRF attacks via unspecified vectors. Public sources in connected docs (IBM security advisories and the NVD entry) corroborate the CSRF impact and tie it to the same Struts versions. The vul...