{"action":"Upgrade org.apache.struts:struts2-core to 2.3.20 or later.","affected":[{"fixed":"2.3.20","introduced":"0"}],"component":"org.apache.struts:struts2-core","cve_ids":["CVE-2014-7809"],"ecosystem":"Maven","epss":0.03377,"exploited":false,"fixed_versions":["2.3.20"],"ghsa_id":"GHSA-h4v9-jf2r-9h6m","id":"tcs_01M5N8ZNRPT0HW7T8ZM7DKK2D9","modified_at":"2024-12-06T05:27:24.632286Z","published_at":"2022-05-14T02:50:59Z","references":["https://osv.dev/vulnerability/GHSA-h4v9-jf2r-9h6m","https://nvd.nist.gov/vuln/detail/CVE-2014-7809","https://github.com/apache/struts/commit/1f301038a751bf16e525607c3db513db835b2999","https://github.com/apache/struts","https://web.archive.org/web/20150201180327/http://www.securitytracker.com/id/1031309","https://web.archive.org/web/20150820131625/http://www.securityfocus.com/bid/71548","https://web.archive.org/web/20201023114849/http://www.securityfocus.com/archive/1/534175/100/0/threaded","http://packetstormsecurity.com/files/129421/Apache-Struts-2.3.20-Security-Fixes.html","http://struts.apache.org/docs/s2-023.html"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-h4v9-jf2r-9h6m","url":"https://osv.dev/vulnerability/GHSA-h4v9-jf2r-9h6m"}],"summary":"Cross-Site Request Forgery in Apache Struts"}