Forum Discussion
spud_141786
Nimbostratus
NimbostratusASM mitigation for vulnerability in Apache Struts
Does anyone know if ASM provides, or can provide, mitigation for this DOS vulnerability in Apache Struts?
https://threatpost.com/apache-warns-of-faulty-zero-day-patch-for-struts/105691
thanks!
2 Replies
natheCirrocumulus
bdy,
I don't know the specifics of this vulnerability but it looks like parameter tampering. If so the ASM can indeed protect on this. You can define Parameters and then, for example, configure what values are allowed, e.g. integers, digits, alphanumeric etc, or allow/disallow specific meta-characters.
This should help mitigate this vulnerability I hope.
N
spud_141786Nir Zigler has a good write up here: https://devcentral.f5.com/articles/apache-struts-classloader-manipulation-vulnerabilities
