CVE-2015-0899

CWE-20 — Improper Input Validation15 documents7 sources
Severity
7.5HIGH
EPSS
69.5%
top 1.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apache Struts
Timeline
PublishedJul 4
Latest updateMay 14

Description

The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶Mavenorg.apache.struts:struts-core1.1 — 1.3.10
▶NVDapache/struts12 versions+11
▶Mavenstruts:struts1.1 — 1.2.9

Patches

Patch: en.osdn.jp ↗Patch: en.osdn.jp ↗

🔴Vulnerability Details

5
OSV
Improper Input Validation in Apache Struts↗2022-05-14
▶
GHSA
Improper Input Validation in Apache Struts↗2022-05-14
▶
GHSA
Improper Input Validation in Apache Struts↗2022-05-13
▶
GHSA
Improper Input Validation in Apache Struts↗2022-05-13
▶
CVEList
CVE-2015-0899: The MultiPageValidator implementation in Apache Struts 1 1↗2016-07-04
▶

📋Vendor Advisories

3
Red Hat
struts: Vulnerability in ActionForm allows unintended remote operations against components on server memory↗2016-06-07
▶
Red Hat
struts: Improper input validation in Validator↗2016-06-07
▶
Red Hat
1: input validation bypass in MultiPageValidator↗2015-03-30
▶

🕵️Threat Intelligence

1
Fortinet
The Analysis of Apache Struts 1 Form Field Input Validation Bypass (CVE-2015-0899)↗2017-10-25
▶

💬Community

5
Bugzilla
CVE-2016-1181 struts: Vulnerability in ActionForm allows unintended remote operations against components on server memory↗2016-06-07
▶
Bugzilla
CVE-2016-1182 struts: Improper input validation in Validator↗2016-06-07
▶
Bugzilla
CVE-2015-0899 struts: Apache Struts 1: input validation bypass in MultiPageValidator [fedora-all]↗2015-08-25
▶
Bugzilla
CVE-2015-0899 struts: Apache Struts 1: input validation bypass in MultiPageValidator [epel-7]↗2015-08-25
▶
Bugzilla
CVE-2015-0899 Apache Struts 1: input validation bypass in MultiPageValidator↗2015-03-30
▶
CVE-2015-0899 (HIGH CVSS 7.5) | The MultiPageValidator implementati | cvebase.io