PT-2012-1239
CVE-2012-4386
·
تاريخ النشر
2012-08-03
·
تاريخ التحديث
2022-05-17
الوصف من
CVSS 2.0
7.5
عاليةالمقاييسAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
Apache Struts versions 2.0.0 through 2.3.4
Description
The issue is related to the implementation of the token check mechanism in Apache Struts, which does not properly validate the token name configuration parameter. This allows remote attackers to perform cross-site request forgery (CSRF) attacks. The exploitation of this issue can enable an attacker to execute unauthorized requests.
Recommendations
For Apache Struts versions 2.0.0 through 2.3.4, update to a version that properly validates the token name configuration parameter to prevent CSRF attacks.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾