S2-044 - Apache Struts 2 Wiki - Apache Software Foundation
DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
Log in
Linked Applications
Loading…
Apache Software Foundation
Spaces
Hit enter to search
Help
Online Help
Keyboard Shortcuts
Feed Builder
What’s new
What’s new
About Confluence
Log in
Apache Struts 2 WikiEdit space details
Child pages
Security Bulletins
S2-044
Browse pagesConfigureSpace tools
Attachments (0)
Page History
Resolved comments
Page Information
View in Hierarchy
View Source
Export to PDF
Export to Word
Copy Page Tree
Pages
Home
Security Bulletins
Jira links
S2-044
Created by      Lukasz Lenart, last updated by      René Gielen on Aug 08, 2019
1 minute read
SummaryPossible DoS attack when using URLValidator
Who should read this
All Struts 2 developers and users
Impact of vulnerability
Possible DoS attack when using URLValidator
Maximum security rating
Low
Recommendation
Upgrade to Struts 2.5.13
Affected Software
Struts 2.5 - Struts 2.5.12
Reporter
Jonathan Bullock <jonbullock at gmail dot com>
CVE Identifier
CVE-2016-8738Problem
If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.Solution
Upgrade to Apache Struts version 2.5.13.Backward compatibility
No backward incompatibility issues are expected.Workaround
Trim passed value before assigning it to a field, e.g.
public String setUserUrl(String userUrl) {
this.userUrl = userUrl.trim();
}
No labels
Overview
Content Tools
Powered by a free Atlassian Confluence Open Source Project License granted to Apache Software Foundation. Evaluate Confluence today.
Powered by Atlassian Confluence 9.2.21
Printed by Atlassian Confluence 9.2.21
Report a bug
Atlassian News
Atlassian
{"serverDuration": 64, "requestCorrelationId": "0e36b5adaa607e9f"}