CVE-2025-54656

Description

** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts.This issue affects Apache Struts Extras: before 2.When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output where part of the message masquerades as a separate log line, confusing consumers of the logs (either human or automated).As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.268

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-54656 are affected in Apache - Struts 1.2.9	Windows
Vulnerabilities CVE-2025-54656 are affected in Apache - struts-extras 1.3.10	Windows
Vulnerabilities CVE-2025-54656 are affected in Apache - Struts for Linux 1.2.9	Linux
Vulnerabilities CVE-2025-54656 are affected in Apache - struts-extras for Linux 1.3.10	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234