CVE-2014-7809

Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protection mechanism

published December 10, 2014

CVSS
—
EPSS
3%
Percentile
88.6
In the wild
Unconfirmed
What it is

Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protection mechanism.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03377 · 88.6th percentile
Published
2014-12-10T15:00Z
EPSS history
Timeline
  • 10 DEC 15:00Z
    Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protection mechanism
    cvelistv5