apache/struts · Security
Incomplete exclude pattern in Apache Struts
- GHSA ID
- GHSA-q2cg-xf9p-h457
- CVE ID
- CVE-2015-1831
- Severity
- high
- Published
- Updated
Description
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. In Struts 2.3.20.1 a better set of exlude patterns was defined.