CVE-2014-7809
Cross-Site Request Forgery in Apache Struts
EPSS 7.5%
Description
Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protection mechanism.
How to fix CVE-2014-7809
To remediate CVE-2014-7809, upgrade the affected package to a fixed version below.
- Maven/org.apache.struts:struts2-core—upgrade to 2.3.20 or later
Is CVE-2014-7809 being exploited?
Moderate — EPSS is 7.5%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (1)
- from 0, < 2.3.20