[Snyk] Upgrade org.apache.struts:struts2-spring-plugin from 2.3.20 to 2.5.26 by andel7 · Pull Request #2 · andel7/java-goof

andel7 · 2021-02-24T08:07:52Z

Snyk has created this PR to upgrade org.apache.struts:struts2-spring-plugin from 2.3.20 to 2.5.26.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 37 versions ahead of your current version.
The recommended version was released 3 months ago, on 2020-11-25.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Server-side Template Injection (SSTI) SNYK-JAVA-ORGFREEMARKER-1076795	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Proof of Concept
Insecure Defaults SNYK-JAVA-ORGAPACHESTRUTSXWORK-474418	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Command Injection SNYK-JAVA-ORGAPACHESTRUTSXWORK-451611	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Mature
Arbitrary Code Execution SNYK-JAVA-ORGAPACHESTRUTSXWORK-30803	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Access Restriction Bypass SNYK-JAVA-ORGAPACHESTRUTSXWORK-30802	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Improper Input Validation SNYK-JAVA-ORGAPACHESTRUTSXWORK-30799	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Parameter Alteration SNYK-JAVA-ORGAPACHESTRUTSXWORK-30798	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Unrestricted Upload of File with Dangerous Type SNYK-JAVA-ORGAPACHESTRUTS-609765	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Denial of Service (DoS) SNYK-JAVA-ORGAPACHESTRUTS-608098	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Proof of Concept
Remote Code Execution (RCE) SNYK-JAVA-ORGAPACHESTRUTS-608097	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Mature
Improper Action Name Cleanup SNYK-JAVA-ORGAPACHESTRUTS-451610	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Remote Code Execution SNYK-JAVA-ORGAPACHESTRUTS-32477	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Mature
Arbitrary Code Execution SNYK-JAVA-ORGAPACHESTRUTS-31503	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Mature
Denial of Service (DoS) SNYK-JAVA-ORGAPACHESTRUTS-31502	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Denial of Service (DoS) SNYK-JAVA-ORGAPACHESTRUTS-31501	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Denial of Service (DoS) SNYK-JAVA-ORGAPACHESTRUTS-31500	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Arbitrary Command Execution SNYK-JAVA-ORGAPACHESTRUTS-31495	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Mature
Directory Traversal SNYK-JAVA-ORGAPACHESTRUTS-30778	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Access Restriction Bypass SNYK-JAVA-ORGAPACHESTRUTS-30776	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Access Restriction Bypass SNYK-JAVA-ORGAPACHESTRUTS-30775	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Cross-site Request Forgery (CSRF) SNYK-JAVA-ORGAPACHESTRUTS-30774	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Arbitrary Command Execution SNYK-JAVA-ORGAPACHESTRUTS-30772	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Mature
Arbitrary Code Execution SNYK-JAVA-ORGAPACHESTRUTS-30771	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Command Injection SNYK-JAVA-ORGAPACHESTRUTS-30770	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Mature
Arbitrary Code Execution SNYK-JAVA-ORGAPACHESTRUTS-30207	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Mature
Manipulation of Struts' internals SNYK-JAVA-ORGAPACHESTRUTS-30060	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Remote Code Execution (RCE) SNYK-JAVA-ORGAPACHESTRUTS-1049003	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Proof of Concept
Arbitrary Code Execution SNYK-JAVA-COMMONSFILEUPLOAD-30401	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Denial of Service (DoS) SNYK-JAVA-COMMONSFILEUPLOAD-30082	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JAVA-ORGAPACHESTRUTSXWORK-30804	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Improper Input Validation SNYK-JAVA-ORGAPACHESTRUTSXWORK-30801	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Cross-site Scripting (XSS) SNYK-JAVA-ORGAPACHESTRUTSXWORK-30800	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JAVA-ORGAPACHESTRUTS-460223	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Cross-site Scripting (XSS) SNYK-JAVA-ORGAPACHESTRUTS-30773	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Denial of Service (DoS) SNYK-JAVA-OGNL-30474	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit
Information Exposure SNYK-JAVA-COMMONSFILEUPLOAD-31540	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

….5.26 Snyk has created this PR to upgrade org.apache.struts:struts2-spring-plugin from 2.3.20 to 2.5.26. See this package in Maven Repository: https://mvnrepository.com/artifact/org.apache.struts/struts2-spring-plugin/ See this project in Snyk: https://app.snyk.io/org/lev-sandox-org/project/02d740d0-e148-423c-8a7d-513fcf4c074a?utm_source=github&utm_medium=upgrade-pr

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade org.apache.struts:struts2-spring-plugin from 2.3.20 to 2.5.26#2

[Snyk] Upgrade org.apache.struts:struts2-spring-plugin from 2.3.20 to 2.5.26#2
andel7 wants to merge 1 commit intomasterfrom
snyk-upgrade-dbc9d864695a3fe41414d9beaa2c2df3

andel7 commented Feb 24, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

andel7 commented Feb 24, 2021

Snyk has created this PR to upgrade org.apache.struts:struts2-spring-plugin from 2.3.20 to 2.5.26.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants