製品・ソフトウェアに関する情報

JVN脆弱性詳細

Apache Struts 2 における Struts 内部を操作される脆弱性

Title	Apache Struts 2 における Struts 内部を操作される脆弱性
Summary	Apache Struts 2 には、Struts 内部を操作される、ユーザセッションを変更される、またはコンテナ設定に影響を受ける脆弱性が存在します。
Possible impacts	リモートの攻撃者により、トップオブジェクトに関する問題によって、Struts 内部を操作される、ユーザセッションを変更される、またはコンテナ設定に影響を受ける可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 21, 2015, midnight
Registration Date	Sept. 12, 2017, 11:28 a.m.
Last Update	Sept. 12, 2017, 11:28 a.m.

CVSS3.0 : 重要
Score	7.5
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS2.0 : 警告
Score	5
Vector	AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected System

Apache Software Foundation

Apache Struts 2.3.24.1 未満の 2.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-5209	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5209
National Vulnerability Database (NVD)
2	CVE-2015-5209	https://nvd.nist.gov/vuln/detail/CVE-2015-5209

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Apache Struts 2 Documentation
1	S2-026	https://struts.apache.org/docs/s2-026.html

その他

No	Name	URL
関連文書
1	Apache Struts Flaw Lets Remote Users Modify the Internal State of the Target Application	http://www.securitytracker.com/id/1033908

Change Log

No	Changed Details	Date of change
0	[2017年09月12日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2015-5209

Summary	Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object.
Publication Date	Aug. 30, 2017, 12:29 a.m.
Registration Date	Jan. 26, 2021, 2:52 p.m.
Last Update	Nov. 21, 2024, 11:32 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:apache:struts:2.3.1.1:::::::*
cpe:2.3:a:apache:struts:2.0.9:::::::*
cpe:2.3:a:apache:struts:2.3.5:::::::*
cpe:2.3:a:apache:struts:2.0.12:::::::*
cpe:2.3:a:apache:struts:2.2.3.1:::::::*
cpe:2.3:a:apache:struts:2.1.0:::::::*
cpe:2.3:a:apache:struts:2.3.20.2:::::::*
cpe:2.3:a:apache:struts:2.3.15:::::::*
cpe:2.3:a:apache:struts:2.0.0:::::::*
cpe:2.3:a:apache:struts:2.3.14:::::::*
cpe:2.3:a:apache:struts:2.0.8:::::::*
cpe:2.3:a:apache:struts:2.0.7:::::::*
cpe:2.3:a:apache:struts:2.0.4:::::::*
cpe:2.3:a:apache:struts:2.3.13:::::::*
cpe:2.3:a:apache:struts:2.2.1:::::::*
cpe:2.3:a:apache:struts:2.3.16:::::::*
cpe:2.3:a:apache:struts:2.3.17:::::::*
cpe:2.3:a:apache:struts:2.3.22:::::::*
cpe:2.3:a:apache:struts:2.3.9:::::::*
cpe:2.3:a:apache:struts:2.1.8.1:::::::*
cpe:2.3:a:apache:struts:2.3.3:::::::*
cpe:2.3:a:apache:struts:2.3.16.3:::::::*
cpe:2.3:a:apache:struts:2.3.4:::::::*
cpe:2.3:a:apache:struts:2.1.3:::::::*
cpe:2.3:a:apache:struts:2.3.23:::::::*
cpe:2.3:a:apache:struts:2.3.6:::::::*
cpe:2.3:a:apache:struts:2.1.2:::::::*
cpe:2.3:a:apache:struts:2.1.5:::::::*
cpe:2.3:a:apache:struts:2.0.1:::::::*
cpe:2.3:a:apache:struts:2.3.15.2:::::::*
cpe:2.3:a:apache:struts:2.3.14.3:::::::*
cpe:2.3:a:apache:struts:2.3.19:::::::*
cpe:2.3:a:apache:struts:2.0.2:::::::*
cpe:2.3:a:apache:struts:2.1.8:::::::*
cpe:2.3:a:apache:struts:2.3.4.1:::::::*
cpe:2.3:a:apache:struts:2.3.20.1:::::::*
cpe:2.3:a:apache:struts:2.0.11.1:::::::*
cpe:2.3:a:apache:struts:2.3.8:::::::*
cpe:2.3:a:apache:struts:2.3.7:::::::*
cpe:2.3:a:apache:struts:2.3.24:::::::*
cpe:2.3:a:apache:struts:2.0.3:::::::*
cpe:2.3:a:apache:struts:2.3.14.2:::::::*
cpe:2.3:a:apache:struts:2.0.14:::::::*
cpe:2.3:a:apache:struts:2.3.10:::::::*
cpe:2.3:a:apache:struts:2.3.15.1:::::::*
cpe:2.3:a:apache:struts:2.3.1:::::::*
cpe:2.3:a:apache:struts:2.0.11:::::::*
cpe:2.3:a:apache:struts:2.3.16.2:::::::*
cpe:2.3:a:apache:struts:2.1.6:::::::*
cpe:2.3:a:apache:struts:2.0.5:::::::*
cpe:2.3:a:apache:struts:2.2.3:::::::*
cpe:2.3:a:apache:struts:2.3.12:::::::*
cpe:2.3:a:apache:struts:2.1.4:::::::*
cpe:2.3:a:apache:struts:2.2.1.1:::::::*
cpe:2.3:a:apache:struts:2.0.11.2:::::::*
cpe:2.3:a:apache:struts:2.0.13:::::::*
cpe:2.3:a:apache:struts:2.3.1.2:::::::*
cpe:2.3:a:apache:struts:2.3.21:::::::*
cpe:2.3:a:apache:struts:2.3.20:::::::*
cpe:2.3:a:apache:struts:2.3.11:::::::*
cpe:2.3:a:apache:struts:2.3.15.3:::::::*
cpe:2.3:a:apache:struts:2.3.16.1:::::::*
cpe:2.3:a:apache:struts:2.1.1:::::::*
cpe:2.3:a:apache:struts:2.0.6:::::::*
cpe:2.3:a:apache:struts:2.0.10:::::::*
cpe:2.3:a:apache:struts:2.3.14.1:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/82550	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/82550	Third Party Advisory VDB Entry
3	http://www.securitytracker.com/id/1033908	Third Party Advisory VDB Entry
4	http://www.securitytracker.com/id/1033908	Third Party Advisory VDB Entry
5	https://security.netapp.com/advisory/ntap-20180629-0002/
6	https://security.netapp.com/advisory/ntap-20180629-0002/
7	https://struts.apache.org/docs/s2-026.html	Mitigation Vendor Advisory
8	https://struts.apache.org/docs/s2-026.html	Mitigation Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:apache:struts:2.3.1.1:::::::*
cpe:2.3:a:apache:struts:2.0.9:::::::*
cpe:2.3:a:apache:struts:2.3.5:::::::*
cpe:2.3:a:apache:struts:2.0.12:::::::*
cpe:2.3:a:apache:struts:2.2.3.1:::::::*
cpe:2.3:a:apache:struts:2.1.0:::::::*
cpe:2.3:a:apache:struts:2.3.20.2:::::::*
cpe:2.3:a:apache:struts:2.3.15:::::::*
cpe:2.3:a:apache:struts:2.0.0:::::::*
cpe:2.3:a:apache:struts:2.3.14:::::::*
cpe:2.3:a:apache:struts:2.0.8:::::::*
cpe:2.3:a:apache:struts:2.0.7:::::::*
cpe:2.3:a:apache:struts:2.0.4:::::::*
cpe:2.3:a:apache:struts:2.3.13:::::::*
cpe:2.3:a:apache:struts:2.2.1:::::::*
cpe:2.3:a:apache:struts:2.3.16:::::::*
cpe:2.3:a:apache:struts:2.3.17:::::::*
cpe:2.3:a:apache:struts:2.3.22:::::::*
cpe:2.3:a:apache:struts:2.3.9:::::::*
cpe:2.3:a:apache:struts:2.1.8.1:::::::*
cpe:2.3:a:apache:struts:2.3.3:::::::*
cpe:2.3:a:apache:struts:2.3.16.3:::::::*
cpe:2.3:a:apache:struts:2.3.4:::::::*
cpe:2.3:a:apache:struts:2.1.3:::::::*
cpe:2.3:a:apache:struts:2.3.23:::::::*
cpe:2.3:a:apache:struts:2.3.6:::::::*
cpe:2.3:a:apache:struts:2.1.2:::::::*
cpe:2.3:a:apache:struts:2.1.5:::::::*
cpe:2.3:a:apache:struts:2.0.1:::::::*
cpe:2.3:a:apache:struts:2.3.15.2:::::::*
cpe:2.3:a:apache:struts:2.3.14.3:::::::*
cpe:2.3:a:apache:struts:2.3.19:::::::*
cpe:2.3:a:apache:struts:2.0.2:::::::*
cpe:2.3:a:apache:struts:2.1.8:::::::*
cpe:2.3:a:apache:struts:2.3.4.1:::::::*
cpe:2.3:a:apache:struts:2.3.20.1:::::::*
cpe:2.3:a:apache:struts:2.0.11.1:::::::*
cpe:2.3:a:apache:struts:2.3.8:::::::*
cpe:2.3:a:apache:struts:2.3.7:::::::*
cpe:2.3:a:apache:struts:2.3.24:::::::*
cpe:2.3:a:apache:struts:2.0.3:::::::*
cpe:2.3:a:apache:struts:2.3.14.2:::::::*
cpe:2.3:a:apache:struts:2.0.14:::::::*
cpe:2.3:a:apache:struts:2.3.10:::::::*
cpe:2.3:a:apache:struts:2.3.15.1:::::::*
cpe:2.3:a:apache:struts:2.3.1:::::::*
cpe:2.3:a:apache:struts:2.0.11:::::::*
cpe:2.3:a:apache:struts:2.3.16.2:::::::*
cpe:2.3:a:apache:struts:2.1.6:::::::*
cpe:2.3:a:apache:struts:2.0.5:::::::*
cpe:2.3:a:apache:struts:2.2.3:::::::*
cpe:2.3:a:apache:struts:2.3.12:::::::*
cpe:2.3:a:apache:struts:2.1.4:::::::*
cpe:2.3:a:apache:struts:2.2.1.1:::::::*
cpe:2.3:a:apache:struts:2.0.11.2:::::::*
cpe:2.3:a:apache:struts:2.0.13:::::::*
cpe:2.3:a:apache:struts:2.3.1.2:::::::*
cpe:2.3:a:apache:struts:2.3.21:::::::*
cpe:2.3:a:apache:struts:2.3.20:::::::*
cpe:2.3:a:apache:struts:2.3.11:::::::*
cpe:2.3:a:apache:struts:2.3.15.3:::::::*
cpe:2.3:a:apache:struts:2.3.16.1:::::::*
cpe:2.3:a:apache:struts:2.1.1:::::::*
cpe:2.3:a:apache:struts:2.0.6:::::::*
cpe:2.3:a:apache:struts:2.0.10:::::::*
cpe:2.3:a:apache:struts:2.3.14.1:::::::*