org.apache.struts:struts2-assembly (>=2.0.11, <=2.3.37), org.apache.struts:struts2-showcase (>=2.0.5, <=2.3.37) +1 more potentially affected by CVE-2017-9791 via org.apache.struts:struts2-struts1-plugin (>=2.0.5, <=2.3.37)

org.apache.struts:struts2-struts1-plugin MAVEN version =2.0.5, =2.0.11, =2.0.5, =1.0, =1.1 Source cves: CVE-2017-9791 Source advisory: OSV:GHSA-29RM-6752-GVWV...

org.apache.struts:struts2-assembly (>=2.0.11, <=2.3.37), org.apache.struts:struts2-showcase (>=2.0.5, <=2.3.37) +1 more potentially affected by CVE-2017-9791 via org.apache.struts:struts2-struts1-plugin (>=2.0.5, <=2.3.37)

org.apache.struts:struts2-struts1-plugin MAVEN version =2.0.5, =2.0.11, =2.0.5, =1.0, =1.1 Source cves: CVE-2017-9791 Source advisory: GHSA-29RM-6752-GVWV...

Remote Code Execution (RCE)

struts2-struts1-plugin is vulnerable to remote code execution RCE attacks. These attacks are possible because the user input are not sanitized and are directly passed through messages.add to be used as a part of an error message in the ActionMessage class. This doesn't affect users of the Struts...