Bettridgekameron

**Name of the Vulnerable Software and Affected Versions** FACTION versions prior to 1.8.3 **Description** The `AccessControlInterceptor`, which serves as the authentication gate for all Struts2 actions, fails to verify the existence of a valid session before calling `invocation.invoke()`. Additionally, four action methods within `BoilerPlateConfig` lack local session validation. This allows an unauthenticated attacker to read, overwrite, deactivate, and permanently delete any boilerplate template within the system. **Recommendations** Update to version 1.8.3.