CVE-2015-0899
Fixed in a distro release EPSS 21%
The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.
Products: apache struts
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.struts:struts-core | no fix |
| Maven | struts:struts | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | hadoop-fips-3.3.6 | no fix |
| Chainguard | hadoop-fips-3.4.2 | no fix |
| Chainguard | hadoop-fips-3.5 | no fix |
| Debian 6.0 | libstruts1.2-java | 1.2.9-4+deb6u2 |
| Debian 7 | libstruts1.2-java | 1.2.9-5+deb7u2 |