Skip to main content
VulnerabilityPublished

Apache Struts 2 REST Plugin: @StrutsParameter checks do not cover @JsonAnySetter

Source JVN Japan

0
Severity
Medium

Rated by Threat Radar

Data as of 29 Oct 2026, 04:28 UTC

What to do

AI-suggested

Until a fix is available, users should review their use of @JsonAnySetter in conjunction with @StrutsParameter and consider additional access controls or input validation as a temporary measure.

Description

The Apache Struts 2 REST Plugin has a vulnerability where the @StrutsParameter authorization checks do not apply to members annotated with Jackson's @JsonAnySetter. This means that certain parameters may bypass intended authorization controls.

References

Community reviews

Loading reviews…