You are here

Apache Struts2 Vulnerabilites S2-017, S2-018, S2-019

IDs: 
CVE-2013-2248, CVE-2013-4310, CVE-2013-4316, S2-017, S2-018, S2-019
Keywords: 
struts2, DMI
Description: 

Three new Apache Struts2 vulnerabilities (S2-017, S2-018, S-019) have been released. An attacker may use

  • S2-017 for phishing attacks via crafted URLs
  • S2-018 to bypass Struts2 security constraints
  • S2-019 for other unspecified attacks related to dynamic method invocation

Affected Struts2 versions are 2.0.0 up to 2.3.15.1.

Airlock is not affected because Apache Struts2 is not installed/used in Airlock.

Resolution: 

If you are using Apache Struts2 on a back-end system we strongly recommend to update Struts2 to version 2.3.15.2 or higher.

Component: 
Airlock
Airlock Vulnerability Status: 
Does not affect Airlock
Back-end Vulnerability Status: 
Back-ends may be vulnerable, see resolution