EUVD-2026-59606
GHSA-87hf-473v-8h9c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
AC:H reflects that reliable exploitation requires concurrent request timing overlap; PR:L confirmed as low-privilege authenticated; impact is confidentiality-only.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected.
This issue affects Apache Struts: 7.2.1.
Users are recommended to upgrade to version 7.3.0, which fixes the issue.
AnalysisAI
Cross-request data leakage in Apache Struts 7.2.1's JSON plugin allows an authenticated remote attacker to observe response content associated with a concurrent request belonging to a different user. The root cause is a thread-safety defect (CWE-567) in the SMD/JSON-RPC interceptor, where per-response serialization state is not isolated between concurrent requests. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The SMD/JSON-RPC handling mode of the Apache Struts JSON interceptor must be explicitly enabled in the application's struts.xml or equivalent configuration - this mode is not active by default. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The overall risk profile is moderate-to-low despite the network-accessible attack vector. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated low-privilege user sends a high volume of concurrent JSON-RPC requests to a Struts 7.2.1 application with the SMD/JSON-RPC interceptor enabled, exploiting the unsynchronized serialization state to observe fragments of response content generated for another user's simultaneous request - potentially including sensitive field values serialized as part of that user's JSON response. No public exploit code has been identified at time of analysis, so successful exploitation currently depends on manual implementation of the concurrent-request timing technique. |
| Remediation | The primary and recommended fix is to upgrade Apache Struts to version 7.3.0, which resolves the serialization state isolation defect. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, a
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, a
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in o
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which all
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag in
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not
The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers
Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted acti
The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via t
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today