CVE-2025-54656
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-07-30

Last updated on: 2025-11-04

Assigner: Apache Software Foundation

Description
** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts. This issue affects Apache Struts Extras: before 2. When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output where part of the message masquerades as a separate log line, confusing consumers of the logs (either human or automated).  As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-07-30
Last Modified
2025-11-04
Generated
2026-05-07
AI Q&A
2025-07-30
EPSS Evaluated
2026-05-05
NVD
CVE-2025-54656
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
apache struts_extras to 2.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-117 The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is an Improper Output Neutralization for Logs issue in Apache Struts Extras before version 2. When using LookupDispatchAction, Struts may log untrusted input without filtering it properly. This can allow specially-crafted input to appear in the logs as if it were separate log lines, potentially confusing those who read or process the logs.


How can this vulnerability impact me? :

The vulnerability can cause log entries to be misleading or confusing by allowing attackers to inject crafted input that appears as separate log lines. This can hinder log analysis, potentially masking malicious activity or causing misinterpretation of log data. Since the affected product is retired and no fix will be released, users should either switch to alternatives or restrict access to trusted users to mitigate risk.


What immediate steps should I take to mitigate this vulnerability?

Since Apache Struts Extras before version 2 is affected and no fix will be released due to the project being retired, immediate mitigation steps include finding an alternative to this software or restricting access to the affected instance to trusted users only.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart