-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from case-sensitive parameter handling in HttpParameters class. The commit shows critical changes making parameter operations case-insensitive: 1) get() was modified to use equalsIgnoreCase, 2) contains() added case-insensitive iteration, 3) remove() added case-aware iterator removal, and 4) appendAll() gained case-aware cleanup. These functions previously allowed attackers to bypass security checks by manipulating parameter casing, enabling path traversal through specially crafted upload parameters. The added test cases in HttpParametersTest.java explicitly verify the case-insensitive behavior, confirming these were the vulnerable points.
org.apache.struts2.dispatcher.HttpParameters.getcore/src/main/java/org/apache/struts2/dispatcher/HttpParameters.java
org.apache.struts2.dispatcher.HttpParameters.containscore/src/main/java/org/apache/struts2/dispatcher/HttpParameters.java
org.apache.struts2.dispatcher.HttpParameters.removecore/src/main/java/org/apache/struts2/dispatcher/HttpParameters.java
org.apache.struts2.dispatcher.HttpParameters.appendAllcore/src/main/java/org/apache/struts2/dispatcher/HttpParameters.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.struts:struts2-core | maven | >= 6.0.0, < 6.3.0.2 | 6.3.0.2 |
| org.apache.struts:struts2-core | maven | >= 2.0.0, < 2.5.33 | 2.5.33 |
JavaJava