The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack
    when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version
    2.5.16 and switch to an optional Jackson XML handler as described here
    http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom
    XML handler based on the Jackson XML handler from the Apache Struts 2.5.16. (CVE-2018-1327)

The version of Apache Struts running on the remote host is prior to 2.5.16. It, therefore, contains a flaw in the REST plugin when using the XStream handler that is triggered during the handling of a specially crafted request with an XML payload. This may allow a remote  attacker to cause a denial of service.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
421902	SCA: security update for org.apache.struts:struts2-rest-plugin (GHSA-38cr-2ph5-frr9)	Tenable Cloud Security	SCA Checks	Local	high
421902	SCA: security update for org.apache.struts:struts2-rest-plugin (GHSA-38cr-2ph5-frr9)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
108760	Apache Struts XStream Handler REST Plugin XML Request Handling Remote DoS (S2-056)	Nessus	Misc.	Combined	high

Detections

Analytics

CVE-2018-1327

high

Tenable Plugins

high

high

high