Not rated
CVE-2018-1327 The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a…
Description
The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Struts | Versions not published |
References
- security.netapp.com security.netapp.com
- www.oracle.com www.oracle.com
- 1040575 www.securitytracker.com
- 103516 www.securityfocus.com
- cwiki.apache.org cwiki.apache.org
- [struts-issues] 20201207 [jira] [Created] (WW-5105) Tracking the fix commit of CVE-2005-3745 and CVE-2018-1327 lists.apache.org
- [struts-issues] 20201207 [jira] [Updated] (WW-5105) Tracking the fix commit of CVE-2005-3745 and CVE-2018-1327 lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Struts
The 33 CVEs of Apache Struts →
CVE-2026-104714
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache…
Not rated
CVE-2026-104713
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin
Not rated
CVE-2026-104712
Asymmetric resource consumption (amplification) vulnerability in Apache Struts
Not rated
CVE-2026-104711
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')…
Not rated