REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering
High severity
GitHub Reviewed
Published
Oct 16, 2018
to the GitHub Advisory Database
•
Updated Jan 5, 2024
Package
Affected versions
>= 2.5.0, < 2.5.13
>= 2.1.2, < 2.3.34
Patched versions
2.5.13
2.3.34
Description
Published to the GitHub Advisory Database
Oct 16, 2018
Reviewed
Jun 16, 2020
Last updated
Jan 5, 2024
The REST Plugin in Apache Struts 2.1.2 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
References