CVE

Id
52969  
CVE No.
CVE-2011-5057  
Status
Candidate  
Description
Apache Struts 2.3.1.1 and earlier provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces. NOTE: the vendor disputes the significance of this report because of an "easy work-around in existing apps by configuring the interceptor."  
Phase
Assigned (20120108)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
561281 52969 CVE-2011-5057 MISC:http://codesecure.blogspot.com/2011/12/struts-2-session-tampering-via.html  View
561282 52969 CVE-2011-5057 CONFIRM:https://issues.apache.org/jira/browse/WW-2264  View
561283 52969 CVE-2011-5057 CONFIRM:https://issues.apache.org/jira/browse/WW-3631  View
561284 52969 CVE-2011-5057 SECUNIA:47109  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
25355 JVNDB-2012-001062 Apache Tomcat の HTTP Digest Access Authentication 実装における完全性保護の要求を回避される脆弱性 Apache Tomcat の HTTP Digest Access Authentication 実装は、qop 値をチェックしないため、完全性保護の要求を回避される脆弱性が存在します。 CVE-2011-5062 52969 5 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-001062.html  View