search

TreyM-WSS / Struts2-Examples

Struts2 Examples
0 stars 0 forks source link

CVE-2021-31805 (Critical) detected in multiple libraries #246

Open mend-for-github-com[bot] opened 2 years ago

mend-for-github-com[bot] commented 2 years ago

CVE-2021-31805 - Critical Severity Vulnerability

Vulnerable Libraries - struts2-core-2.1.8.jar, struts2-core-2.3.12.jar, struts2-core-2.3.8.jar, struts2-core-2.3.15.jar

struts2-core-2.1.8.jar

Apache Struts 2

Library home page: http://struts.apache.org/struts2

Path to dependency file: /Struts2RemeberMeMaven/pom.xml

Path to vulnerable library: /canner/.m2/repository/org/apache/struts/struts2-core/2.1.8/struts2-core-2.1.8.jar,/Struts2RemeberMeMaven/target/Struts2RemeberMeMaven/WEB-INF/lib/struts2-core-2.1.8.jar

Dependency Hierarchy: - :x: **struts2-core-2.1.8.jar** (Vulnerable Library)

struts2-core-2.3.12.jar

Apache Struts 2

Path to dependency file: /Struts2RestConvention/pom.xml

Path to vulnerable library: /canner/.m2/repository/org/apache/struts/struts2-core/2.3.12/struts2-core-2.3.12.jar,/Struts2MessageStoreExample/target/Struts2MessageStoreExample/WEB-INF/lib/struts2-core-2.3.12.jar,/canner/.m2/repository/org/apache/struts/struts2-core/2.3.12/struts2-core-2.3.12.jar,/canner/.m2/repository/org/apache/struts/struts2-core/2.3.12/struts2-core-2.3.12.jar,/Struts2RestConvention/target/Struts2Rest/WEB-INF/lib/struts2-core-2.3.12.jar,/Struts2JsonValidation/target/Struts2JsonValidation-1.0/WEB-INF/lib/struts2-core-2.3.12.jar,/canner/.m2/repository/org/apache/struts/struts2-core/2.3.12/struts2-core-2.3.12.jar,/Struts2Convention/target/Struts2Convention/WEB-INF/lib/struts2-core-2.3.12.jar,/Struts2Junit4/target/Struts2Junit4-1.0/WEB-INF/lib/struts2-core-2.3.12.jar,/canner/.m2/repository/org/apache/struts/struts2-core/2.3.12/struts2-core-2.3.12.jar

Dependency Hierarchy: - :x: **struts2-core-2.3.12.jar** (Vulnerable Library)

struts2-core-2.3.8.jar

Apache Struts 2

Path to dependency file: /Struts2Spring3Hibernate/pom.xml

Path to vulnerable library: /Struts2Spring3Hibernate/target/Struts2Spring3Hibernate3/WEB-INF/lib/struts2-core-2.3.8.jar,/canner/.m2/repository/org/apache/struts/struts2-core/2.3.8/struts2-core-2.3.8.jar

Dependency Hierarchy: - :x: **struts2-core-2.3.8.jar** (Vulnerable Library)

struts2-core-2.3.15.jar

Apache Struts 2

Path to dependency file: /Struts2MavenSample/pom.xml

Path to vulnerable library: /Struts2MavenSample/target/Struts2MavenSample-1.0/WEB-INF/lib/struts2-core-2.3.15.jar,/canner/.m2/repository/org/apache/struts/struts2-core/2.3.15/struts2-core-2.3.15.jar

Dependency Hierarchy: - :x: **struts2-core-2.3.15.jar** (Vulnerable Library)

Found in HEAD commit: 4a2d705eb04097186f260a255e43e17302189741

Found in base branch: master

Vulnerability Details

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.

Publish Date: 2022-04-12

URL: CVE-2021-31805

CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cwiki.apache.org/confluence/display/WW/S2-062

Release Date: 2022-04-12

Fix Resolution: 2.2.3

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.