Struts2 漏洞信息汇总_a vulnerability introduced by manipulating paramet-优快云博客

这篇博客列举了Apache Struts2从S2-001到S2-061的所有已知安全漏洞，包括远程代码执行、跨站脚本、目录遍历等严重问题，揭示了Struts2框架在安全性上的挑战和历史演变。

官方链接如下：
https://cwiki.apache.org/confluence/display/WW/Security+Bulletins

最近，不出意外Struts2 又双叒叕一次被爆出RCE 漏洞【S2-061 Struts 远程代码执行漏洞（CVE-2020-17530）】
每次Struts2 RCE 漏洞爆发的时候都在想，如果有个地方能统一看一下Struts2 的历史漏洞就好了，网上搜索了下居然没有，翻了下Struts2 官网，终于找到了需要的内容

截至本文发布时，所以已经爆出的Struts2 漏洞如下

S2-001 — Remote code exploit on form validation error
S2-002 — Cross site scripting (XSS) vulnerability on <s:url> and <s:a> tags
S2-003 — XWork ParameterInterceptors bypass allows OGNL statement execution
S2-004 — Directory traversal vulnerability while serving static content
S2-005 — XWork ParameterInterceptors bypass allows remote command execution
S2-006 — Multiple Cross-Site Scripting (XSS) in XWork generated error pages
S2-007 — User input is evaluated as an OGNL expression when there's a conversion error
S2-008 — Multiple critical vulnerabilities in Struts2
S2-009 — ParameterInterceptor vulnerability allows remote command execution
S2-010 — When using Struts 2 token mechanism for CSRF protection, token check may be bypassed by misusing known session attributes
S2-011 — Long request parameter names might sign