exploitable remotely over HTTP - **Attack Complexity: Low** — no special conditions required - **Privileges Required: None** — no authentication needed - **User Interaction: None** — no user action required - **Scope: Changed** — could affect components beyond Apache Struts - **Impact: High** on Con