6.8

CVE-2014-7809

Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protection mechanism.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Struts Version 2.0.0
Apache ≫ Struts Version 2.0.1
Apache ≫ Struts Version 2.0.2
Apache ≫ Struts Version 2.0.3
Apache ≫ Struts Version 2.0.4
Apache ≫ Struts Version 2.0.5
Apache ≫ Struts Version 2.0.6
Apache ≫ Struts Version 2.0.7
Apache ≫ Struts Version 2.0.8
Apache ≫ Struts Version 2.0.9
Apache ≫ Struts Version 2.0.10
Apache ≫ Struts Version 2.0.11
Apache ≫ Struts Version 2.0.11.1
Apache ≫ Struts Version 2.0.11.2
Apache ≫ Struts Version 2.0.12
Apache ≫ Struts Version 2.0.13
Apache ≫ Struts Version 2.0.14
Apache ≫ Struts Version 2.1.0
Apache ≫ Struts Version 2.1.1
Apache ≫ Struts Version 2.1.2
Apache ≫ Struts Version 2.1.3
Apache ≫ Struts Version 2.1.4
Apache ≫ Struts Version 2.1.5
Apache ≫ Struts Version 2.1.6
Apache ≫ Struts Version 2.1.8
Apache ≫ Struts Version 2.1.8.1
Apache ≫ Struts Version 2.2.1
Apache ≫ Struts Version 2.2.1.1
Apache ≫ Struts Version 2.2.3
Apache ≫ Struts Version 2.2.3.1
Apache ≫ Struts Version 2.3.1
Apache ≫ Struts Version 2.3.1.1
Apache ≫ Struts Version 2.3.1.2
Apache ≫ Struts Version 2.3.3
Apache ≫ Struts Version 2.3.4
Apache ≫ Struts Version 2.3.4.1
Apache ≫ Struts Version 2.3.7
Apache ≫ Struts Version 2.3.8
Apache ≫ Struts Version 2.3.12
Apache ≫ Struts Version 2.3.14
Apache ≫ Struts Version 2.3.14.1
Apache ≫ Struts Version 2.3.14.2
Apache ≫ Struts Version 2.3.14.3
Apache ≫ Struts Version 2.3.15
Apache ≫ Struts Version 2.3.15.1
Apache ≫ Struts Version 2.3.15.2
Apache ≫ Struts Version 2.3.15.3
Apache ≫ Struts Version 2.3.16
Apache ≫ Struts Version 2.3.16.1
Apache ≫ Struts Version 2.3.16.2
Apache ≫ Struts Version 2.3.16.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.51% 0.883
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
http://packetstormsecurity.com/files/129421/Apache-Struts-2.3.20-Security-Fixes.html
http://struts.apache.org/docs/s2-023.html
Vendor Advisory
http://www.securityfocus.com/archive/1/534175/100/0/threaded
http://www.securityfocus.com/bid/71548
http://www.securitytracker.com/id/1031309