Apache Struts2 Core 7.4.0 Timing Side Channel

Apache Struts2 Core version 7.4.0 and below contains a timing side-channel vulnerability in TokenHelper token comparisons that may allow attackers to infer valid session token values...