news
Full Disclosure
November 2nd, 2026 at 6:10 AMApache Struts2 Core Cross-Origin Protection Exemption Miskeyed to a Deployment-Wide Path
Posted by Daniel Owens via Fulldisclosure on Nov 01 Description Apache Struts2 Core version 7.4.0 and below's `FetchMetadataInterceptor`, `CoepInterceptor`, and `CoopInterceptor` each compare their `exemptedPaths` configuration -- a per-interceptor-reference, administrator-supplied set of paths intended to exempt specific actions from the corresponding cross-origin protection -- against `HttpServletRequest.getContextPath()`. `getContextPath()` is fixed for the entire deployed web...
#ai
Get stories like this every Monday
The week's most important AI news in one email. Free, unsubscribe anytime.
Score: 3.09
Engagement proxy: 0
Canonical link: https://seclists.org/fulldisclosure/2026/Nov/3