Apache Struts Extras Improper Output Neutralization for Logs Vulnerability

A vulnerability has been identified in Apache Struts Extras versions prior to 2, involving improper output neutralization for logs. This issue arises when the LookupDispatchAction is used, as Struts may inadvertently log untrusted input without proper filtering. Such specially-crafted input can disrupt log interpretation by masquerading part of the message as a separate log entry, potentially confusing human or automated log consumers. As this project is retired, no fix will be released, and users are advised to seek alternatives or limit access to trusted users.

Impact

Exploitation of this vulnerability can lead to log injection, where untrusted input is logged in a way that confuses log consumers, either human or automated.