Description (CNA)
Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Apache Software Foundation / Apache Struts | affected 2.0.0 before 2.2.1 |
| Apache Software Foundation / Apache Struts | affected 2.2.1 through 6.1.0 |
CWE
CWE-611
References
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.
An XML processing flaw has been found in Apache Struts. Parsing of XML configuration in the XWork component does not validate XML in proper way and it's vulnerable to XML external entity (XXE) injection.