It seems Crowd 4.2 uses Struts version 2.5.17 and CVE-2020-17530 states that anything less that 2.5.26 is vulnerable to remote code execution attacks. I do not know if forced OGNL evaluation is used or not but I am being told to update. Is there a documented way to update Struts only on Crowd servers?
Blocking new comments as this is no longer needed.
It looks like you're new here. Sign in or register to get started.
