CVE-2015-1831 - The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "comp

CVE-2015-1831

Summary

The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.

References

http://www.securityfocus.com/bid/75940
http://www.securitytracker.com/id/1032985
https://struts.apache.org/docs/s2-024.html

Vulnerable Configurations

cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 22-09-2017 - 01:29)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	75940
confirm	https://struts.apache.org/docs/s2-024.html
sectrack	1032985

Last major update

22-09-2017 - 01:29

Published

16-07-2015 - 14:59

Last modified

22-09-2017 - 01:29