CVE-2013-4310 indicates the action prefix (action:) feature of struts2 framework is vulnerable. Hence the vendor released the patch(?) by disabling this feature. However, there is an option to enable this feature back.

Question: What are the security implications on the same (enabling this feature back). Is there any other measures that can be taken to mitigate the risks exposed by this vulnerability?

The action prefix feature is to navigate to different actions based on the button the user chooses to click. Now what are the alternatives to the same? One option is to have a javascript that handles the onclick and change the form's action but here the URL in the browser will be changed. Is there any other elegant option available?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.