Apache Struts Security Restriction Bypass Vulnerability (CVE-2015-0899)

Apache Struts Security Restriction Bypass Vulnerability (CVE-2015-0899)
Apache Struts Security Restriction Bypass Vulnerability (CVE-2015-0899)

Release date:
Updated on:

Affected Systems:

Apache Group Struts 1.1

Description:

Bugtraq id: 74423
CVE (CAN) ID: CVE-2015-0899

Struts is the open source code used to build Web applications.

The input verification bypass vulnerability exists in the MultiPageValidator function of Apache Struts 1.2.9 and earlier versions. Attackers can exploit this vulnerability to bypass security restrictions and perform unauthorized operations.

<* Source: vendor
*>

Suggestion:

Vendor patch:

Apache Group
------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://struts.apache.org/download.cgi#struts23151

Refer:
Http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000042.html
Https://jvn.jp/en/jp/JVN86448949/index.html
Http://en.sourceforge.jp/projects/terasoluna/wiki/StrutsPatch2-EN

Upload struts2 files (Save As BLOB)

Getting started instance of Struts2

Implement the ModelDriven interface in Struts2

Struts2 file downloading garbled

Struts2 Spring integration methods and principles

Several knowledge points about Struts2 annotation Mode

Struts details: click here
Struts: click here

This article permanently updates the link address: