Michael Mullins

**Name of the Vulnerable Software and Affected Versions** Apache Wicket versions prior to 8.19.0 Apache Wicket versions prior to 9.24.0 Apache Wicket versions prior to 10.11.0 **Description** Improper validation of resource URL attributes allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve. The locale, style, and variation attributes decoded from a package resource URL are spliced into the resource lookup path without being checked for path separators. Because the `IPackageResourceGuard` and `WebApplicationPath` do not inspect the attacker-controlled portion of the path, a crafted request can escape the intended package directory on servlet containers that normalize `..` in `ServletContext.getResource()`. The readable files are limited to extensions permitted by the configured `IPackageResourceGuard`. Applications using the blocklist-based `PackageResourceGuard` or custom patterns may disclose configuration files such as `web.xml`. Additionally, the lookup process can act as an existence oracle for arbitrary paths. **Recommendations** Upgrade to version 8.19.0. Upgrade to version 9.24.0. Upgrade to version 10.11.0.

**Name of the Vulnerable Software and Affected Versions** Apache Struts versions 6.0.0 through 6.10.0 Apache Struts versions 7.0.0 through 7.2.1 **Description** An uncontrolled resource consumption issue exists where an application exposing an endpoint for collecting Content Security Policy (CSP) violation reports reads the submitted report into memory without limits. This allows a single request to exhaust the heap, leading to a denial of service for other users. These endpoints are typically accessible without authentication. The core distribution does not map such an endpoint by default, meaning applications that do not collect violation reports are not affected. **Recommendations** Upgrade Apache Struts versions 6.0.0 through 6.10.0 to version 6.11.0. Upgrade Apache Struts versions 7.0.0 through 7.2.1 to version 7.3.0.

**Name of the Vulnerable Software and Affected Versions** Apache Struts versions 2.1.8 through 2.3.37 Apache Struts versions 2.5.0 through 2.5.33 Apache Struts versions 6.0.0 through 6.10.0 Apache Struts versions 7.0.0 through 7.2.1 **Description** An uncontrolled resource consumption issue exists in the JSON plugin. When an application is configured to populate actions from a JSON request body, the plugin reads the body into memory without a bound on the accepted size. This can allow a single request to exhaust the heap, resulting in a denial of service for other users. The configurable JSON input length limit does not prevent this behavior. This issue only affects applications that use the optional JSON plugin with JSON request-body handling enabled. **Recommendations** Upgrade versions 2.1.8 through 6.10.0 to version 6.11.0. Upgrade versions 7.0.0 through 7.2.1 to version 7.3.0. As a temporary mitigation, disable the JSON plugin or disable JSON request-body handling.