CVE-2014-7809
Vulnerability from cvelistv5
Published
2014-12-10 15:00
Modified
2024-08-06 13:03
Severity ?
EPSS score ?
Summary
Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protection mechanism.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:03:27.319Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/129421/Apache-Struts-2.3.20-Security-Fixes.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://struts.apache.org/docs/s2-023.html"
},
{
"name": "71548",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/71548"
},
{
"name": "1031309",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1031309"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html"
},
{
"name": "20141208 [ANN] Apache Struts 2.3.20 GA release available with security fix",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/534175/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-12-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable \u003cs:token/\u003e values, which allows remote attackers to bypass the CSRF protection mechanism."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/129421/Apache-Struts-2.3.20-Security-Fixes.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://struts.apache.org/docs/s2-023.html"
},
{
"name": "71548",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/71548"
},
{
"name": "1031309",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1031309"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html"
},
{
"name": "20141208 [ANN] Apache Struts 2.3.20 GA release available with security fix",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/534175/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2014-7809",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable \u003cs:token/\u003e values, which allows remote attackers to bypass the CSRF protection mechanism."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"
},
{
"name": "http://packetstormsecurity.com/files/129421/Apache-Struts-2.3.20-Security-Fixes.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/129421/Apache-Struts-2.3.20-Security-Fixes.html"
},
{
"name": "http://struts.apache.org/docs/s2-023.html",
"refsource": "CONFIRM",
"url": "http://struts.apache.org/docs/s2-023.html"
},
{
"name": "71548",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/71548"
},
{
"name": "1031309",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1031309"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html"
},
{
"name": "20141208 [ANN] Apache Struts 2.3.20 GA release available with security fix",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/534175/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2014-7809",
"datePublished": "2014-12-10T15:00:00",
"dateReserved": "2014-10-03T00:00:00",
"dateUpdated": "2024-08-06T13:03:27.319Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2014-7809\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2014-12-10T15:59:01.347\",\"lastModified\":\"2018-10-09T19:53:28.947\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable \u003cs:token/\u003e values, which allows remote attackers to bypass the CSRF protection mechanism.\"},{\"lang\":\"es\",\"value\":\"Apache Struts 2.0.0 hasta 2.3.x anterior a 2.3.20 utiliza valores previsibles, lo que permite a atacantes remotos evadir el mecanismo de protecci\u00f3n CSRF.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":6.8},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5CF11DCF-6F6E-4E18-988E-E43918FBB8A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE3A90B7-C632-4D3E-9A4F-21E46D273B42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"386538BE-F258-4870-8E11-750ADA228026\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B4CF15B9-3714-4206-9971-1F7D59E20483\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DFA32D87-65C7-4589-86B7-500BE3203CFA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"98C3FB11-4E24-4067-A3A9-021F849DAAE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DCF2D72-90F1-4D1B-94A2-5BB3D8C086C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"661F1610-9FCD-4FC1-BCA1-69C58E0A1389\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9C89E22-B106-4EAB-90A1-0EA86C165737\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E1BABB2-780E-47E0-87A9-A164906C8421\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AC32348E-7EF4-411C-9A44-CD041ABFA0E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"94BD452B-AE41-4F7A-9DB9-4B1039582537\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ACFDC53B-7B8E-4333-BC87-E01024EC9C21\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F0818E7-B617-4C30-BFAC-9FE2F375F8BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"50F4A58E-F3D4-4711-A37E-EA538B112371\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFFCC96F-FD87-4495-B8A5-19D7898D5662\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEA0424E-84B4-41BD-8E6C-93E2A77DD6CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CEC53AE5-3640-4FE1-B0B1-EA26C5B9EB9B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"662A2E4B-A76A-4498-98A6-F90DF65C62B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4E720B3A-4CFB-47FE-B80C-67C59D4C7FD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA687B56-A09B-4741-84F1-2BD9569A3F76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0BC0E358-8B4D-480B-BFAE-966CB697310A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B7E8E1C-C667-4AED-86A5-2BD0C62AAD76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"88B3348C-1086-4A16-97E3-52DB65FF860A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C65711D-9C5B-4644-A12D-82243CB6FB1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FC1FA9A7-2C8E-4651-9400-190198528642\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA9093C0-AE6A-4285-B159-8FDBF37E33D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"267A1C33-1C95-41DA-8A01-6F20C7BE1772\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7E4590B9-6A44-4DC6-B7DF-5E6CAAA9D25A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"30860683-D403-4D24-B356-FD306AEFCA46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4E3316DA-9E34-4955-91CA-E35B141A7007\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D152B29-FAD5-4DEA-B187-278EBD37FEB4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2AC68463-F500-471C-8600-8F8FD9743B12\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A92AAE08-4811-465A-8178-25F5F349B8BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B487975D-6394-4136-B45C-C1F209465B24\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDC41957-8CCA-46A6-BD31-4039EEF3C457\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"443B4E64-2A36-49C6-B09D-77B3BDF69709\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2481505C-4FD1-4195-9E10-9DD741498FB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"28ED63DB-2AAF-4BC9-A844-074EDF63C89A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"38A6CEED-6C43-4325-B36C-9F254CCDFDC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"41F43088-26AA-4890-A9D6-1B9B48D5F02A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE6820E3-8FDF-4BDF-8B62-E604A91F1280\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D25ED06A-F12C-443E-9B3F-FDDF52FE9D93\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"44527919-8403-42A8-9CE1-3B4F58630F34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EBB91D8A-14B8-4263-B90D-F776535F9B8F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FB525941-7175-43C1-9F17-814F5F7C72CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F10D559E-04A0-4002-947C-D3902138795B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"89203DD8-2C95-4546-9504-83654FFA5DBC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB3D5644-CFAC-4FB5-A1FB-387F97876098\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1225A0B0-C3F2-4579-BFE9-F8DB2CF596F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8DC883A7-0766-4857-ABC8-9DB4BA713650\"}]}]}],\"references\":[{\"url\":\"http://packetstormsecurity.com/files/129421/Apache-Struts-2.3.20-Security-Fixes.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://struts.apache.org/docs/s2-023.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securityfocus.com/archive/1/534175/100/0/threaded\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securityfocus.com/bid/71548\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securitytracker.com/id/1031309\",\"source\":\"secalert@redhat.com\"}]}}"
}
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.