CVE-2011-5057 Missing authorization in n/a
Remote attackers can modify run-time data values in Apache Struts applications by exploiting improperly restricted access to session and request collections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2011-5057?
CVE-2011-5057 is a medium-severity missing authorization vulnerability in Apache Struts, published on 8 Jan 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces. NOTE: the vendor disputes the significance of this report because of an "easy work-around in existing apps by configuring the interceptor."
Weakness: CWE-264
Which versions are affected by CVE-2011-5057?
It affects 1 product.
Products include Apache Struts.
How do I fix CVE-2011-5057?
No fix has been published for CVE-2011-5057 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2011-5057 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-5057 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Apache Struts
Sources
Also known as GHSA-x5vg-p6mw-ffv4.