CWE-109: Struts: Validator Turned Off
Description
Automatic filtering via a Struts bean has been turned off, which disables the Struts Validator and custom validation logic. This exposes the application to other weaknesses related to insufficient input validation.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- Access Control
Bypass Protection Mechanism
Potential mitigations
- Implementation
Ensure that an action form mapping enables validation. Set the validate field to true.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.