The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to “compromise internal state of an application” via unspecified vectors.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1831
Reference (s):
- BID:75940
- URL: http://www.securityfocus.com/bid/75940
- https://struts.apache.org/docs/s2-024.html
- SECTRACK:1032985
- URL: http://www.securitytracker.com/id/1032985