Security Vulnerabilities fixed in Apache Struts S2-008

Description

To prevent attackers calling arbitrary methods within parameters the flagxwork.MethodAccessor.denyMethodExecutionis set totrueand theSecurityMemberAccessfieldallowStaticMethodAccessis set tofalseby default. Also, to prevent access to context variables an improved character whitelist for parameter names is applied in theParameterInterceptorsince Struts 2.2.1.1:

Affected Applications

Apache Struts

CVE References

CVE-2012-0392 CVE-2012-0393 CVE-2012-0391 CVE-2012-0394

Other References

https://cwiki.apache.org/confluence/display/WW/Security+Bulletins