Posted by Daniel Owens via Fulldisclosure on Nov 01
Description
Apache Struts2 Core version 7.4.0 and below’s `FetchMetadataInterceptor`, `CoepInterceptor`, and `CoopInterceptor` each
compare their `exemptedPaths` configuration — a per-interceptor-reference, administrator-supplied set of paths
intended to exempt specific actions from the corresponding cross-origin protection — against
`HttpServletRequest.getContextPath()`. `getContextPath()` is fixed for the entire deployed web…
Source: Full Disclosure (seclists.org) · 2026-11-02