-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from Dynamic Method Invocation (DMI) being enabled by default. The key functions are the ParameterAction implementations in DefaultActionMapper that process 'method:' and 'action:' parameters. These functions dynamically set the action method based on user input when allowDynamicMethodCalls=true (the default in vulnerable versions). The patch explicitly disables this flag by default and adds request attribute checks to prevent exploitation. The direct modification of these execute methods in the commit confirms their role in the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.struts:struts2-core | maven | >= 2.0.0, < 2.3.15.2 | 2.3.15.2 |
| org.apache.struts:struts2-rest-plugin | maven | >= 2.0.0, < 2.3.15.2 | 2.3.15.2 |
JavaJavaKEV Misses 88% of Exploited CVEs- Get the report