Versions Compared

Old Version 2

changes.mady.by.user Unknown User (lukaszlenart)

Saved on

compared with

New Version Current

changes.mady.by.user Unknown User (lukaszlenart)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Excerpt

A DoS attack is available for Spring secured actions


Who should read this

All Struts 2 developers and users

Impact of vulnerability

A DoS attack is available for Spring secured actions

Maximum security rating

Medium

Important

Recommendation

Upgrade to Struts 2.5.12 or Struts 2.3.33

Affected Software

Struts 2.3.7 - Struts 2.3.32, Struts 2.5 - Struts 2.5.10.1

Reporter

 

Yasser Zamani <yasser dot zamani at live dot com>

CVE Identifier

 

CVE-2017-9787

Problem

When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack when even if user was not properly authenticated but an application mixed secured and not secured actions in one class.

Solution

Upgrade to Apache Struts version 2.5.12 or 2.3.33.

Backward compatibility

No backward incompatibility issues are expected.

...

Code Block
<constant name="struts.additional.excludedPatterns" value=".\.accessDecisionManager\.." />

 

...