Apache Struts2 Tiles Plugin has cache vulnerabilities in versions 6.3.0 and 7.4.0
Original title: Apache Struts2 Tiles Plugin <=7.4.0 and >=6.3.0 Preparer Cache Vulnerabilities
Unsynchronized unbounded caches in Apache Struts2 Tiles plugin can lead to corrupted cache entries and infinite loops under load.
The Apache Struts2 Tiles plugin codebase includes a ViewPreparer construct with multiple ViewPreparer factories containing unsynchronised unbounded caches. The lack of proper synchronisation means certain factories will create caches that race, risking lost cache entries and corrupted internal bucket states under load. This can result in infinite loops.
- Unsynchronised caches in ViewPreparer factories
- Risk of lost cache entries and corrupted bucket states
- Affects versions <=7.4.0 and >=6.3.0
Impact: cache corruption leading to denial of service or information disclosure
- Vendors
- Apache
- Products
- Struts2 Tiles Plugin
From the original article
Posted by Daniel Owens via Fulldisclosure on Nov 04 The Apache Struts2 Tiles plugin version =6. 3. 0) codebase includes a `ViewPreparer` construct, replete with multiple ViewPreparer factories, that contains several important vulnerabilities including unsynchronised, unbounded caches.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.