CVE-2015-0899

Severity CVSS v4.0:
Pending analysis
Type:
CWE-20 Input Validation
Publication date:
04/07/2016
Last modified:
12/04/2025

Description

The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:apache:struts:1.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:1.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:1.1:b1:*:*:*:*:*:*
cpe:2.3:a:apache:struts:1.1:b2:*:*:*:*:*:*
cpe:2.3:a:apache:struts:1.1:b3:*:*:*:*:*:*
cpe:2.3:a:apache:struts:1.1:rc1:*:*:*:*:*:*
cpe:2.3:a:apache:struts:1.1:rc2:*:*:*:*:*:*
cpe:2.3:a:apache:struts:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:1.2.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:1.2.6:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:1.2.7:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:1.2.8:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:1.2.9:*:*:*:*:*:*:*
cpe:2.3:a:apache:struts:1.3.5:*:*:*:*:*:*:*