Apache Struts CSRF Bypass Vulnerability (CVE-2014-7809)

Apache Struts CSRF Bypass Vulnerability (CVE-2014-7809)

Release date:
Updated on:

Affected Systems:
Apache Group Struts 2.0.0-2.3.20
Description:
CVE (CAN) ID: CVE-2014-7809

Struts is an open source architecture used to build Web applications.

The token value generated by Apache Struts 2.0.0-2.3.20 can be predicted, which allows remote attackers to bypass the CSRF protection mechanism.

<* Source: & #197; & #129; ukasz

Link: http://www.securityfocus.com/archive/1/archive/1/534175/100/0/threaded
*>

Suggestion:
Vendor patch:

Apache Group
------------
Currently, the vendor has released the Struts 2.3.20 patch to fix this security problem. Please download it from the vendor's homepage:

Http://struts.apache.org/download.cgi#struts2320
Http://struts.apache.org/docs/s2-023.html

Upload struts2 files (Save As BLOB)

Getting started instance of Struts2

Implement the ModelDriven interface in Struts2

Struts2 file downloading garbled

Struts2 Spring integration methods and principles

Several knowledge points about Struts2 annotation Mode

Struts details: click here
Struts: click here

This article permanently updates the link address: