** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1 when developer mode is used allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not \a security vulnerability itself.\