Vulnerability: Apache Struts <2.3.1.1 - Remote Code Execution

Apache Struts before 2.3.1.1 is susceptible to remote code execution. When developer mode is used in the DebuggingInterceptor component, a remote attacker can execute arbitrary OGNL commands via unspecified vectors, which can allow for execution of malware, obtaining sensitive information, modifying data, and/or gaining full control over a compromised system without entering necessary credentials.. NOTE: the vendor characterizes this behavior as not “a security vulnerability itself.”

Impact

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on the affected server.

Severity

medium

Verified

Unknown