PT-2016-2330

CVE-2015-0899

Publicado

2015-05-15

Atualizado

2026-10-15

Descrição por

CVSS 3.1

7.5

Alta

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Struts versions 1.1 through 1.3.10

Description The issue allows remote attackers to bypass intended access restrictions. This is due to insufficient input validation in the MultiPageValidator implementation. The exploitation can occur through a modified page parameter.

Recommendations For Apache Struts versions 1.1 through 1.3.10, consider restricting access to the MultiPageValidator implementation until a patch is available. As a temporary workaround, avoid using the modified page parameter in the affected API endpoint.

Explorabilidade

Correção

Impactos

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-20: Improper Input Validation

Identificadores relacionados

CVE-2015-0899

BDU:2016-01719

GHSA-CVVX-R33M-V7PQ

DLA-292-1