Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.

The version of Apache Struts running on the remote host is 2.x prior to 2.3.15.2. It, therefore, is affected by multiple Dynamic Method Invocation (DMI) vulnerabilities as DMI is enabled by default. 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the MySQL Enterprise Monitor running on the remote host is affected by multiple unspecified vulnerabilities related to dynamic method invocation (DMI) in the bundled version of Apache Struts.

According to its self-reported version, the MySQL Enterprise Monitor running on the remote host is affected by the multiple vulnerabilities in the bundled version of Apache Struts :

  - Input validation errors exist that allows the execution     of arbitrary Object-Graph Navigation Language (OGNL)     expressions via specially crafted parameters to the     DefaultActionMapper. (CVE-2013-2251)

  - Multiple unspecified vulnerabilities exist related to     dynamic method invocation being enabled by default.
    (CVE-2013-4316)

MySQL was updated to version 5.5.37 to address various security issues.

More information is available at http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.h tml#AppendixMSQL and http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.h tml#AppendixMSQL .

The remote web application appears to use Struts 2, a web framework used for creating Java web applications. The version of Struts 2 in use is affected by a security constraint bypass vulnerability due to a flaw in the action mapping mechanism. Under certain unspecified conditions, an attacker could exploit this issue to bypass security constraints. 

Note that this version of Struts 2 is known to have Dynamic Method Invocation (DMI) enabled by default. This can expose Struts 2 to additional vulnerabilities so it is recommended that DMI be disabled. (CVE-2013-4316)

Note that this plugin will only report the first vulnerable instance of a Struts 2 application.

ID	Name	Product	Family	Severity
117402	Apache Struts 2.x < 2.3.15.2 Dynamic Method Invocation Multiple Vulnerabilities (S2-019)	Nessus	Misc.	critical
83297	MySQL Enterprise Monitor 3.0.x < 3.0.5 Apache Struts DMI Multiple Vulnerabilities	Nessus	CGI abuses	critical
83292	MySQL Enterprise Monitor < 2.3.14 Apache Struts Multiple Vulnerabilities	Nessus	CGI abuses	critical
74373	SuSE 11.3 Security Update : MySQL (SAT Patch Number 9303)	Nessus	SuSE Local Security Checks	critical
70168	Apache Struts 2 'action:' Parameter Prefix Security Constraint Bypass	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2013-4316

critical

Tenable Plugins

critical

critical

critical

critical

medium