Apache Struts2 S2-056(CVE-2018-1327)

Summary A crafted XML request can be used to perform a DoS attack when using the Struts REST plugin | | | | :------------ | :------------ | | Who should read this | All Struts 2 developers and users which are using the REST plugin | | Impact of vulnerability | A DoS attack is possible when using...

PT-2018-3988

Name of the Vulnerable Software and Affected Versions Apache Struts versions prior to 2.5.16 Description The issue is related to the Apache Struts REST Plugin using a vulnerable XStream library, allowing a denial of service DoS attack with a malicious request containing a specially crafted XML...

Security Advisory - Remote Code Execution Vulnerability in Jackson JSON library of Apache Struts2

Apache Struts2 released a remote code execution vulnerability in S2-055 on the official website. An attacker is possible to perform a Remote Code Execution RCE attack with a malicious JSON packet. Vulnerability ID: HWPSIRT-2017-12002 This vulnerability has been assigned a Common Vulnerabilities a...

JexBoss - JBoss (and others Java Deserialization Vulnerabilities) verify and EXploitation Tool

JexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server and others Java Platforms, Frameworks, Applications, etc. Requirements Python = 2.7.x urllib3 ipaddress Installation on Linux\Mac To install the latest version of JexBoss, please use the following commands: g...

Apache Struts2 Jackson Library Remote Code Execution (CVE-2017-15095; CVE-2017-17485; CVE-2017-7525; CVE-2018-7489)

Vulnerability exists in Jackson data-bind library. This vulnerability is due to deserialization of untrusted data. A successful exploitation of this issue could allow an attacker to execute arbitrary code on the remote system...

Denial Of Service (DoS)

struts2-rest-plugin is vulnerable to denial of service DoS attacks. These attacks are possible through the use of a vulnerable version of the json-lib library. Attackers can trigger a DoS attack using a JSON payload which causes a memory leak to occur...

Apache Struts2 S2-055 DoS Vulnerability

Exploit for multiple platform in category dos / poc Summary Vulnerability in the Jackson JSON library Who should read this All Struts 2 developers and users which are using the REST plugin Impact of vulnerability Not clear, please read the linked issue for more details...

Apache Struts2 S2-054 DoS Vulnerability

Exploit for multiple platform in category dos / poc Summary A crafted JSON request can be used to perform a DoS attack when using the Struts REST plugin Who should read this All Struts 2 developers and users which are using the REST plugin Impact of vulnerability A DoS attack is possible when usi...

com.moomanow.web:moomanowwebapp (>=0.0.1, <=0.0.10), com.moomanow:moomanow-struts2-core (>=0.0.4, <=0.1.0) +2 more potentially affected by CVE-2017-15707 via org.apache.struts:struts2-rest-plugin (>=2.5, <=2.5.14.1)

org.apache.struts:struts2-rest-plugin MAVEN version =2.5, =0.0.1, =0.0.4, =2.5, =2.5, =2.5.14.1 Source cves: CVE-2017-15707 Source advisory: MEND:CVE-2017-15707...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8) +239 more potentially affected by CVE-2016-4461 via org.apache.struts:struts2-core (>=2.0.5, <=2.3.28.1)

org.apache.struts:struts2-core MAVEN version =2.0.5, =2.0.0, =1.2.1, =1.5.3, =1.5.3, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =1.0, =1.0, =1.0, =1.0, =1.0.4 and more Source cves: CVE-2016-4461 Source advisory: MEND:CVE-2016-4461...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8) +224 more potentially affected by CVE-2015-5169 via org.apache.struts:struts2-core (>=2.0.5, <=2.3.16.3)

org.apache.struts:struts2-core MAVEN version =2.0.5, =2.0.0, =1.2.1, =1.5.3, =1.5.3, =1.0, =1.0, =1.0, =1.0, =2.0.0, =0.5.9, =0.5.10.2 and more Source cves: CVE-2015-5169 Source advisory: MEND:CVE-2015-5169...

com.amashchenko.struts2.actionflow:struts2-actionflow-plugin (>=1.5.3, <=2.4.0), com.amashchenko.struts2.actionflow:struts2-actionflow-showcase (>=1.5.3, <=2.4.0) +187 more potentially affected by CVE-2017-9804 via org.apache.struts:struts2-core (>=2.3.7, <=2.3.33)

org.apache.struts:struts2-core MAVEN version =2.3.7, =1.5.3, =1.5.3, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =1.0, =1.0, =1.0, =1.0, =2.0.0, =0.5.9, =1.2.0, =1.0.0, =1.2.6 and more Source cves: CVE-2017-9804 Source advisory: MEND:CVE-2017-9804...

com.github.kaitoy.sneo:giane (>=1.2.0, <=1.2.3), com.googlecode.struts2-conversation:struts2-conversation-scope-plugin (1.3.1) +13 more potentially affected by CVE-2016-6795 via org.apache.struts:struts2-convention-plugin (>=2.3.1, <=2.3.30)

org.apache.struts:struts2-convention-plugin MAVEN version =2.3.1, =1.2.0, =1.1.0, =3.3.0, =3.3.0, =2.3.1, =2.3.1, =2.3.1, =2.3.1, =2.2.1, =2.2, =3.2.0, =1.0, =1.2.2, =1.3.5 Source cves: CVE-2016-6795 Source advisory: MEND:CVE-2016-6795...

com.amashchenko.struts2.pdfstream:struts2-pdfstream-plugin (2.0.0), com.amashchenko.struts2.pdfstream:struts2-pdfstream-showcase (2.0.0) +94 more potentially affected by CVE-2016-8738 via org.apache.struts:struts2-core (>=2.5, <=2.5.12)

org.apache.struts:struts2-core MAVEN version =2.5, =1.0.0-release, =2.5.0, =2.5.0, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.2 and more Source cves: CVE-2016-8738 Source advisory: MEND:CVE-2016-8738https:/...

com.amashchenko.struts2.pdfstream:struts2-pdfstream-plugin (2.0.0), com.amashchenko.struts2.pdfstream:struts2-pdfstream-showcase (2.0.0) +94 more potentially affected by CVE-2017-9804 via org.apache.struts:struts2-core (>=2.5, <=2.5.12)

org.apache.struts:struts2-core MAVEN version =2.5, =1.0.0-release, =2.5.0, =2.5.0, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.2 and more Source cves: CVE-2017-9804 Source advisory: MEND:CVE-2017-9804https:/...

com.moomanow.web:moomanowwebapp (>=0.0.1, <=0.0.10), com.moomanow:moomanow-struts2-core (>=0.0.4, <=0.1.0) +2 more potentially affected by CVE-2017-9793 via org.apache.struts:struts2-rest-plugin (>=2.5, <=2.5.12)

org.apache.struts:struts2-rest-plugin MAVEN version =2.5, =0.0.1, =0.0.4, =2.5, =2.5, =2.5.12 Source cves: CVE-2017-9793 Source advisory: MEND:CVE-2017-9793...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8) +243 more potentially affected by CVE-2017-12611 via org.apache.struts:struts2-core (>=2.0.5, <=2.3.33)

org.apache.struts:struts2-core MAVEN version =2.0.5, =2.0.0, =1.2.1, =1.5.3, =1.5.3, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =1.0, =1.0, =1.0, =1.0, =1.0.4 and more Source cves: CVE-2017-12611 Source advisory: MEND:CVE-2017-12611...

org.apache.struts:struts2-assembly (>=2.2.1, <=2.3.33), org.apache.struts:struts2-rest-showcase (>=2.1.2, <=2.3.33) +5 more potentially affected by CVE-2017-9793 via org.apache.struts:struts2-rest-plugin (>=2.1.2, <=2.3.33)

org.apache.struts:struts2-rest-plugin MAVEN version =2.1.2, =2.2.1, =2.1.2, =2.0-rc2.3, =1.0, =1.0.1 - org.meruvian.yama:yama-struts-core 1.0.1 Source cves: CVE-2017-9793 Source advisory: MEND:CVE-2017-9793...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (2.5.0), org.apache.struts:struts2-assembly (>=2.5, <=2.5.2) +3 more potentially affected by CVE-2016-6795 via org.apache.struts:struts2-convention-plugin (>=2.5, <=2.5.2)

org.apache.struts:struts2-convention-plugin MAVEN version =2.5, =2.5, =2.5, =2.5, =2.5, =2.5.2 Source cves: CVE-2016-6795 Source advisory: MEND:CVE-2016-6795...

com.moomanow.web:moomanowwebapp (>=0.0.1, <=0.0.10), com.moomanow:moomanow-struts2-core (>=0.0.4, <=0.1.0) +2 more potentially affected by CVE-2017-9805 via org.apache.struts:struts2-rest-plugin (>=2.5, <=2.5.12)

org.apache.struts:struts2-rest-plugin MAVEN version =2.5, =0.0.1, =0.0.4, =2.5, =2.5, =2.5.12 Source cves: CVE-2017-9805 Source advisory: MEND:CVE-2017-9805...