Support Article
Upgrade struts version due to vulnerability issue
SA-64793
Summary
Apache Struts CVE-2018-11776 security vulnerability occurs when using Struts 2.3.35 in Pega 7.3.1.
Error Messages
Not Applicable
Steps to Reproduce
Not Applicable
Root Cause
The security vulnerability was suggested by Apache for Struts JAR files with 2.3.XX versions. Recommended to use Struts 2.5.17.
Resolution
Use Universal System Management Application (SMA) for all PRPC and Pega versions. The same is identified by searching for 'Universal' in the version information of the SMA.
Apply the following hotfixes:
- HFix-46844 for Tomcat server.
- HFix-46946 for WepSphere server.
Published October 12, 2018 - Updated October 8, 2020
Have a question? Get answers now.
Visit the Collaboration Center to ask questions, engage in discussions, share ideas, and help others.