THIS IS A TEST INSTANCE. ALL YOUR CHANGES WILL BE LOST!!!!
...
Who should read this | All Struts 2 developers and users |
|---|---|
Impact of vulnerability | If a production system using Struts 2 has been updated to fix a particular historic security issue and was not updated thereafter to fix later documented security issues up to and including S2-057, it is possible that said production system is still vulnerable to the specific vulnerability that was meant to be fixed by a taking measures as explained in the affected historic security issue bulletin. |
Maximum security rating | Moderate |
Recommendation | |
Affected Software | Struts 2.0.0 - 2.5.12 |
Reporter | Ben Ronallo from the Black Duck research team within SynopsysChristopher Fearon and the Black Duck Research Team within the Synopsys Cybersecurity Research Center |
CVE Identifier | - |
Problem
Struts Security Bulletins contain a listing of affected GA release versions for given issues, along with a recommended minimum GA release version to fix this particular issue. Thorough investigations conducted by the reporting entity revealed that in many cases more Struts releases were affected than originally reported and that higher minimum fix versions are required.
...