Does struts2.3.15.3 security issue also affect the tiles plugin?

Question

I upgraded struts2 to 2.3.32 with no problem, but I also depend on struts2-tiles-plugin-2.3.15.3.jar which I can't upgrade as easily. Is this a problem or is upgrading struts2-core enough to fix the issue?

You can also use https://github.com/apache/struts-extras to *fix* security issue. — Aleksandr M, Jun 15 '17 at 17:36

score 1 · Accepted Answer · answered Jun 15 '17 at 13:19

1

No I think. At S2-046's workaround section I read:

Another option is to remove the File Upload Interceptor from the stack

Which means that vulnerability was inside core. However, struts2-tiles-plugin does not have dependency to core!

answered Jun 15 '17 at 13:19

Yasser Zamani

2,380
21
18

Does struts2.3.15.3 security issue also affect the tiles plugin?

1 Answers1