Apache Struts's DebuggingInterceptor component allows remote code execution in developer mode
Moderate severity
GitHub Reviewed
Published
May 4, 2022
to the GitHub Advisory Database
•
Updated Mar 5, 2024
Package
Affected versions
< 2.3.18
Patched versions
2.3.18
Description
Published by the National Vulnerability Database
Jan 8, 2012
Published to the GitHub Advisory Database
May 4, 2022
Reviewed
Dec 27, 2023
Last updated
Mar 5, 2024
Credits
-
sunSUNQ Analyst
-
MarkLee131 Analyst
The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."
References