Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 7 Jul 2017 18:47:13 +0200
From: Lukasz Lenart <>
To: Struts Users Mailing List <>
Cc: "" <>, 
	Struts Developers List <>,, icez <>, 
	"" <>,,
Subject: [ANN] Apache Struts 2: possible RCE in the Struts Showcase app in the
 Struts 1 plugin example in the Struts 2.3.x series

A potential security vulnerability was reported in the Struts 1 plugin
used in the Struts 2.3.x series. It is possible to perform a Remote
Code Execution attack if given construction exists in the vulnerable
application. Please read the security bulletin for more details and
inspect your application.

- S2-048 Possible RCE in the Struts Showcase app in the Struts 1
plugin example in Struts 2.3.x series

NOTE: Please notice that this vulnerability does not affect
applications using Struts 2.5.x series or applications that do not use
the Struts 1 plugin. Even if the plugin is available but certain code
construction is not present, your application is safe.

On behalf of the Apache Struts project

Kind regards
+ 48 606 323 122

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.