CVE-2014-7809
published 2014-12-10CVE-2014-7809: Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable values, which allows remote attackers to bypass the CSRF protection mechanism.
PriorityP339medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
3.49%
87.8th percentile
Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable values, which allows remote attackers to bypass the CSRF protection mechanism.
Affected
51 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Cross-Site Request Forgery in Apache Struts
ghsa·2022-05-14
CVE-2014-7809 [MEDIUM] CWE-352 Cross-Site Request Forgery in Apache Struts
Cross-Site Request Forgery in Apache Struts
Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable values, which allows remote attackers to bypass the CSRF protection mechanism.
OSV
Cross-Site Request Forgery in Apache Struts
osv·2022-05-14
CVE-2014-7809 [MEDIUM] Cross-Site Request Forgery in Apache Struts
Cross-Site Request Forgery in Apache Struts
Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable values, which allows remote attackers to bypass the CSRF protection mechanism.
Red Hat
struts2: predictable generation of form submission token
vendor_redhat·2014-12-08·CVSS 6.8
CVE-2014-7809 [MEDIUM] CWE-330 struts2: predictable generation of form submission token
struts2: predictable generation of form submission token
Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable values, which allows remote attackers to bypass the CSRF protection mechanism.
Statement: A previous statement by Red Hat related to this CVE, prior to August 2019, said that Apache Struts 2 is not included in any Red Hat products. This earlier statement was incorrect. While Struts 2 is not actively compiled, shipped, used, or enabled in any Red Hat provided final products, and does not cause any vulnerability in the product, struts2-core jars have been included in some products' source code packages. The inclusion was part of an import of the Google Guice repository, which includes struts2-core. Customers that build artefacts from our source code could be at risk. Re
No detection rules found.
No public exploits indexed.
http://packetstormsecurity.com/files/129421/Apache-Struts-2.3.20-Security-Fixes.htmlhttp://struts.apache.org/docs/s2-023.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlhttp://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.htmlhttp://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlhttp://www.securityfocus.com/archive/1/534175/100/0/threadedhttp://www.securityfocus.com/bid/71548http://www.securitytracker.com/id/1031309http://packetstormsecurity.com/files/129421/Apache-Struts-2.3.20-Security-Fixes.htmlhttp://struts.apache.org/docs/s2-023.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlhttp://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.htmlhttp://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlhttp://www.securityfocus.com/archive/1/534175/100/0/threadedhttp://www.securityfocus.com/bid/71548http://www.securitytracker.com/id/1031309
2014-12-10
Published