Launchpad.net

CVE 2015-1831

The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.

See the CVE page on Mitre.org for more details.

References