VDB
BDU%3A2015-09977
BDU%3A2015-09977
PUBLISHED
CVSS 6.800000190734863 MEDIUM
Уязвимость программной платформы Apache Struts, связанная с использованием предсказуемых значений <s:token/>, позволяющая удаленному нарушителю осуществить CSRF-атаку
Risk Scores
CVSS 2.0
6.800000190734863
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation, Oracle Corp., IBM Corp. | Struts, WebCenter Sites, Oracle FLEXCUBE Private Banking, IBM Call Center for Commerce, MySQL Enterprise Monitor |
Timeline
- May 7, 2015 CVE Published
- Oct 10, 2022 CVE Updated
References
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7809 url
- http://struts.apache.org/docs/s2-023.html url
- https://packetstormsecurity.com/files/129421/Apache-Struts-2.3.20-Security-Fixes.html url
- http://www.securityfocus.com/bid/71548 url
- http://www.securityfocus.com/archive/1/534175/100/0/threaded url
- https://www.securitytracker.com/id/1031309 url
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-call-center-and-apache-struts-struts-upgrade-strategy-various-cves-see-below/ url
- https://www.oracle.com/security-alerts/cpuoct2016.html url
- https://www.oracle.com/security-alerts/cpuapr2015.html url
- https://www.oracle.com/security-alerts/cpujul2015.html url
- https://cwiki.apache.org/confluence/display/WW/S2-023 advisory