CVE-2013-2248 Medium Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

CVE-2013-2248 - Medium Severity Vulnerability

Vulnerable Libraries - struts2-core-2.0.8.jar, struts2-core-2.0.11.jar

struts2-core-2.0.8.jar

null

path: /java_security_book/Struts2/s2_002/target/struts2-archetype-starter/WEB-INF/lib/struts2-core-2.0.8.jar,/java_security_book/Struts2/s2_001/target/struts2-archetype-starter/WEB-INF/lib/struts2-core-2.0.8.jar,2/repository/org/apache/struts/struts2-core/2.0.8/struts2-core-2.0.8.jar

Dependency Hierarchy:

• ❌ struts2-core-2.0.8.jar (Vulnerable Library)

struts2-core-2.0.11.jar

null

path: /java_security_book/Struts2/s2_005/target/struts2-archetype-starter/WEB-INF/lib/struts2-core-2.0.11.jar

Dependency Hierarchy:

• ❌ struts2-core-2.0.11.jar (Vulnerable Library)

Vulnerability Details

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.

Publish Date: 2013-07-20

URL: CVE-2013-2248

CVSS 2 Score Details (5.8)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: http://struts.apache.org/release/2.3.x/docs/s2-017.html

Release Date: 2017-12-31

Fix Resolution: Developers should immediately upgrade to Struts 2.3.15.1

---

Step up your Open Source Security Game with WhiteSource here