EUVD-2026-59605
GHSA-gvf6-rf7m-9h3g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
AC:H reflects the non-default JSON plugin prerequisite and concurrent timing dependency; PR:L confirmed by vendor CVSS; no integrity or availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intended. Populating actions from a JSON request body is not enabled by default; applications that do not use the JSON plugin are not affected.
This issue affects Apache Struts: 7.2.1.
Users are recommended to upgrade to version 7.3.0, which fixes the issue.
AnalysisAI
Cross-request data exposure in the Apache Struts JSON plugin (version 7.2.1) results from per-request parsing state being improperly shared across concurrent requests, enabling information observable in one user's session to leak into another's. Authenticated remote attackers targeting applications that have explicitly enabled JSON action population can exploit this concurrency flaw (CWE-567) to read partial request data or circumvent configured parsing limits. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Apache Struts 7.2.1 application has explicitly enabled the JSON plugin AND configured it to populate action objects from JSON request bodies - this is not the default Struts configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects a network-reachable, low-privilege-required flaw with limited confidentiality impact and no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated attacker with low-privilege access sends a high volume of concurrent JSON requests to a Struts 7.2.1 application with the JSON plugin enabled, timing them to collide during the shared parsing phase. Due to unsynchronized parsing state, the attacker's response may contain data fragments from a concurrent legitimate user's request, exposing sensitive fields such as form input or session-bound parameters. … |
| Remediation | Upgrade Apache Struts to version 7.3.0, the vendor-confirmed fix release documented in advisory S2-070 at https://cwiki.apache.org/confluence/display/WW/S2-070. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, a
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, a
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in o
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which all
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag in
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not
The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers
Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted acti
The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via t
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today