CVE-2018-1327: High severity Apache struts vulnerability
The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-1327?
CVE-2018-1327 is a vulnerability in the Apache Struts REST Plugin that allows for a denial-of-service attack using a specially crafted XML payload.
What is the severity of CVE-2018-1327?
CVE-2018-1327 has a severity rating of high with a CVSS score of 7.5.
How does CVE-2018-1327 affect Apache Struts?
CVE-2018-1327 affects all versions of Apache Struts up to and including version 2.5.14.1.
How can I fix CVE-2018-1327?
To fix CVE-2018-1327, upgrade to Apache Struts version 2.5.16 and switch to an optional Jackson XML handler.
Where can I find more information about CVE-2018-1327?
You can find more information about CVE-2018-1327 at the following references: [http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html](http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html), [http://www.securityfocus.com/bid/103516](http://www.securityfocus.com/bid/103516), [http://www.securitytracker.com/id/1040575](http://www.securitytracker.com/id/1040575).