Versions Compared

Old Version 3

changes.mady.by.user Yasser Zamani

Saved on

compared with

New Version Current

changes.mady.by.user Lukasz Lenart

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Avoid using forced OGNL evaluation on untrusted user input , and/or as recommended in the Security Guide! You can upgrade to Struts 2.5.30 or greater which checks if expression evaluation won't lead to the double evaluation, yet this isn't ultimate solution and still forced expression evaluation can lead to security degradation.

DISCLAIMER

Struts won't accept double evaluation issues caused by not validated end-user input (owing to developer error) anymore as a vulnerability. We accepted this one as a vulnerability because it's about an error in our previously accepted vulnerability. We welcome and appreciate reports in this regard to minimize developer error effect albeiterrors!

Backward compatibility

No issues expected when upgrading to Struts 2.5.30

...