CVE-2018-1327

    Dashboard / Vulnerabilities / CVE-2018-1327

    CVE-2018-1327

    Published: 27 Mar 2018Last Modified: 8 Jul 2026

    Summary:

    Details: The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.

    References: https://lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3%40%3Cissues.struts.apache.org%3E, https://lists.apache.org/thread.html/rf482c101a88445d73cc2e89dbf7f16ae00a4aa79a544a1e72b2326db%40%3Cissues.struts.apache.org%3E, http://www.securityfocus.com/bid/103516, http://www.securitytracker.com/id/1040575, https://security.netapp.com/advisory/ntap-20180330-0001/, https://cwiki.apache.org/confluence/display/WW/S2-056, http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 6a39976815adf55ada5c4e246d57ec13d9a5ec99
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High