CVEs-PoC/2015/CVE-2015-0899.md

CVE-2015-0899

Description

The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.

POC

Reference

• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/IkerSaint/VULNAPP-vulnerable-app
• https://github.com/bingcai/struts-mini
• https://github.com/pctF/vulnerable-app
• https://github.com/weblegacy/struts1