>2) Does Apache Struts only run on Apache Webserver and Tomcat? Should run on java based servers Glassfish, Websphere etc
>3) Is there a simple way to determine if a server has Struts installed, >instead of logging into each of the servers and checking the programs >list? You could try and execute a struts action ie test.action on the server, if struts is there it will reply: There is no Action mapped for namespace [/] and action name [test] associated with context path []. ..but it depends on how the server is setup and how it deals with the 404's. Alternatively Look for a jar struts.x.x.x.jar or struts2-core-x.x.x.jar in the lib directory of tomcat. Struts1 is EOL, Struts2 struts2-core-2.5.13.jar Look at the struts website for security bulletins etc https://struts.apache.org/ On 7 September 2017 at 00:18, Sean Son <linuxmailinglistsem...@gmail.com> wrote: > Hello all > > I am new to the mailing list as well as new to Apache Struts. We all heard > in the news about the vulnerability affecting Apache Struts. I have been > tasked to determine which of our servers have Struts running on them. I > have a few questions on how to determine if a server is running Struts or > not: > > 1) How does one determine if a Windows server, running IIS, has the Apache > Struts framework installed on it? > > 2) Does Apache Struts only run on Apache Webserver and Tomcat? > > 3) Is there a simple way to determine if a server has Struts installed, > instead of logging into each of the servers and checking the programs list? > > > I appreciate ALL help! >
