PT-2016-2330

CVE-2015-0899

Published

2015-05-15

Updated

2026-10-15

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Struts versions 1.1 through 1.3.10

Description The issue allows remote attackers to bypass intended access restrictions. This is due to insufficient input validation in the MultiPageValidator implementation. The exploitation can occur through a modified page parameter.

Recommendations For Apache Struts versions 1.1 through 1.3.10, consider restricting access to the MultiPageValidator implementation until a patch is available. As a temporary workaround, avoid using the modified page parameter in the affected API endpoint.

Exploitability

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

Related identifiers

CVE-2015-0899

BDU:2016-01719

GHSA-CVVX-R33M-V7PQ

DLA-292-1