-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.struts.xwork:xwork-core | maven | >= 2.3.20, <= 2.3.28.1 | 2.3.29 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper OGNL expression handling in token validation. The commit replaced ognlUtil.getValue() with a restricted callMethod() that validates expression simplicity. The original getValue() in OgnlUtil.java and its usage in DefaultActionInvocation.java allowed execution of complex expressions (including arithmetic/chain operations), enabling CSRF bypass. The patch adds checks for simple methods and blocks dangerous expression types, confirming these functions as the vulnerability source.
Ongoing coverage of React2Shell