GHSA-q5q8-jghf-3pm3 CVE-2013-4310

Apache Struts2 Broken Access Control Vulnerability

Medium Maven

Severity: Medium; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): 6.52%; Chance of exploitation in the next 30 days. Higher than 93.79% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-284 Improper Access Control
Fix: 2.3.15.3; Upgrade org.apache.struts:struts2-core to this version or later

Description

The Struts 2 action mapping mechanism supports the special parameter prefix action: which is intended to help with attaching navigational information to buttons within forms, under certain conditions this can be used to bypass security constraints.

In Struts 2.3.15.3 the action mapping mechanism was changed to avoid circumventing security constraints. Two additional constants were introduced to steer behaviour of DefaultActionMapper:

struts.mapper.action.prefix.enabled - when set to false support for "action:" prefix is disabled, set to false by default
struts.mapper.action.prefix.crossNamespaces - when set to false, actions defined with "action:" prefix must be in the same namespace as current action

Affected versions

Maven

Package	Vulnerable	Fixed in
org.apache.struts:struts2-core	`< 2.3.15.3`	`2.3.15.3`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.apache.struts:struts2-core Maven → `2.3.15.3`

maven

<dependency><groupId>org.apache.struts</groupId><artifactId>struts2-core</artifactId><version>2.3.15.3</version></dependency>

gradle

implementation("org.apache.struts:struts2-core:2.3.15.3")

Weakness

CWE-284: Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

How to prevent it

Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2013-4310

Packages

github.com/apache/struts

Timeline

May 17, 2022 Published
Dec 7, 2024 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-8c6j-ffmf-q6vm Apache Struts RCE Vulnerability	High Known exploited	Also affects org.apache.struts:struts2-core
GHSA-47qp-8v9g-39hp Code injection in Apache Struts	Critical Known exploited	Also affects org.apache.struts:struts2-core
GHSA-4wrr-9h5r-m92w Apache Struts Remote Java Code Execution	Critical Known exploited	Also affects org.apache.struts:struts2-core
CVE-2020-17530 Remote code execution in Apache Struts	Critical Known exploited	Also affects org.apache.struts:struts2-core
GHSA-j77q-2qqg-6989 Apache Struts vulnerable to remote arbitrary command execution due to improper input validation	Critical Known exploited	Also affects org.apache.struts:struts2-core
CVE-2018-11776 Apache Struts vulnerable to remote command execution (RCE) due to improper input validation	High Known exploited	Also affects org.apache.struts:struts2-core
GHSA-qcfc-hmrc-59x7 Apache Struts 2 is Missing XML Validation	High	Also affects org.apache.struts:struts2-core
GHSA-rg58-xhh7-mqjw Apache Struts has a Denial of Service vulnerability	High	Also affects org.apache.struts:struts2-core

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor