Page History

...

Struts 2.0.10 corrects a serious security flaw in one of our dependenciesthe Struts 2 tags where using JSP EL expressions. All users are encouraged to update to Struts 2.0.10 or to utilize the XWork 2.0.4 JAR with a prior release of Struts 2. Note that existing pages that utilize JSP EL expressions with Struts 2 tags will not work with this release.

For prior notes in this release series, see Release Notes 2.0.9

...

Significant Fixes

• This release utilizes XWork 2.0.4 which prevents OGNL evaluations of user inputfixes a security flaw in the Struts 2 tags that XXXXXXX.
• Portlet support has been significantly improved in this release.
• For other changes, see the JIRA release notes.

...