5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:P/A:P
0.012 Low
EPSS
Percentile
85.2%
CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard
cookiesName value is used, does not properly restrict access to the
getClass method, which allows remote attackers to “manipulate” the
ClassLoader and modify session state via a crafted request. NOTE: this
vulnerability exists because of an incomplete fix for CVE-2014-0113.
Author | Note |
---|---|
jdstrand | per Debian: <not-affected> (Struts 2.0.0 through to Struts 2.3.16.2) |