-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.struts:struts2-core | maven | < 2.3.20 | 2.3.20 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability description explicitly implicates CookieInterceptor when wildcard cookiesName values are used. The S2-021 bulletin confirms the interceptor's parameter exclusion logic was insufficient to block 'class' access (a vector for ClassLoader manipulation). The first patched version (2.3.20) specifically modified CookieInterceptor's handling of excluded parameters, and the workaround guidance advises against wildcard usage in this interceptor. Though the exact method name isn't explicitly stated in provided sources, the intercept() method is the primary entry point for interceptor logic in Struts, making it the most likely location for the flawed parameter handling.