NVD

Id
35104  
Name
CVE-2014-7809  
Description
Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protection mechanism.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-12-10  
Modified Date
2016-10-25  
Seq
2014-7809  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
179633 35104 CVE-2014-7809 http://packetstormsecurity.com/files/129421/Apache-Struts-2.3.20-Security-Fixes.html  View
179634 35104 CVE-2014-7809 http://struts.apache.org/docs/s2-023.html  View
179635 35104 CVE-2014-7809 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html  View
179636 35104 CVE-2014-7809 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html  View
179637 35104 CVE-2014-7809 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html  View
179638 35104 CVE-2014-7809 20141208 [ANN] Apache Struts 2.3.20 GA release available with security fix  View
179639 35104 CVE-2014-7809 71548  View
179640 35104 CVE-2014-7809 1031309  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
16990 JVNDB-2014-005865 Apache Struts における CSRF 保護メカニズムを回避される脆弱性 Apache Struts には、CSRF 保護メカニズムを回避される脆弱性が存在します。 CVE-2014-7809 75102 CVE-2014-7809 35104 6.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005865.html 2014-12-08 2015-07-29 View