JVN#50890770: Apache Struts 2 vulnerable to denial-of-service (DoS)

Apache Struts 2 provided by The Apache Software Foundation contains a denial-of-service (DoS) vulnerability (CWE-400).

Impact

An attacker may be able to cause a denial-of-service (DoS).

Solution

Update the Software
Update to the latest version according to the information provided by the developer

Apply a Workaround
Apply the following workaround to mitigate the impact of this vulnerability:

Add java.io. and java.nio. to the value attribute of the struts.excludedPackageNames constant in struts-default.xml

However, it is recommended by the developer to update the software.

Products Affected

• Struts 2.0.0 to 2.5.20