CVE-2018-1327
First published: Tue Mar 27 2018(Updated: )
The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.struts:struts2-rest-plugin | >=2.1.1<2.5.16 | 2.5.16 |
| Apache Struts | >=2.1.1<=2.5.14.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2018-1327
- https://cwiki.apache.org/confluence/display/WW/S2-056
- https://lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3@%3Cissues.struts.apache.org%3E
- https://lists.apache.org/thread.html/rf482c101a88445d73cc2e89dbf7f16ae00a4aa79a544a1e72b2326db@%3Cissues.struts.apache.org%3E
- https://security.netapp.com/advisory/ntap-20180330-0001/
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- https://github.com/apache/struts/commit/4260bee634cb606be6071bce2383fddb510608aa
- https://github.com/apache/struts/commit/67ecf3a21608e20449bcb7895b22204b400fecd4
- https://github.com/apache/struts/commit/9260720568cee9e868d2899228eceed0c3359323
- https://web.archive.org/web/20200227124859/http://www.securityfocus.com/bid/103516
- https://web.archive.org/web/20200923124543/http://www.securitytracker.com/id/1040575
- https://github.com/advisories/GHSA-38cr-2ph5-frr9 (Advisory)
- http://www.securityfocus.com/bid/103516
- http://www.securitytracker.com/id/1040575
- https://lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3%40%3Cissues.struts.apache.org%3E
- https://lists.apache.org/thread.html/rf482c101a88445d73cc2e89dbf7f16ae00a4aa79a544a1e72b2326db%40%3Cissues.struts.apache.org%3E
Frequently Asked Questions
What is CVE-2018-1327?
CVE-2018-1327 is a vulnerability in the Apache Struts REST Plugin that allows for a denial-of-service attack using a specially crafted XML payload.
What is the severity of CVE-2018-1327?
CVE-2018-1327 has a severity rating of high with a CVSS score of 7.5.
How does CVE-2018-1327 affect Apache Struts?
CVE-2018-1327 affects all versions of Apache Struts up to and including version 2.5.14.1.
How can I fix CVE-2018-1327?
To fix CVE-2018-1327, upgrade to Apache Struts version 2.5.16 and switch to an optional Jackson XML handler.
Where can I find more information about CVE-2018-1327?
You can find more information about CVE-2018-1327 at the following references: [http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html](http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html), [http://www.securityfocus.com/bid/103516](http://www.securityfocus.com/bid/103516), [http://www.securitytracker.com/id/1040575](http://www.securitytracker.com/id/1040575).
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-38cr-2ph5-frr9
- alias/CVE-2018-1327
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/author
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/remedy
- agent/references
- agent/softwarecombine
- agent/tags
- collector/github-advisory
- source/GitHub
- agent/event
- agent/description
- agent/trending
- vendor/apache
- canonical/apache struts
- version/apache struts/2.1.1
- version/apache struts/2.5.14.1
- package-manager/maven