CVE-2018-1327

published 2018-03-27

CVE-2018-1327: The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted…

high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C N I N A H

The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	struts	2.1.1 – 2.5.14.1	—
apache_software_foundation	apache_struts	—	—

CWE-91