Apache struts’ vulnerability

Most websites offer customers an interactive user experience, allowing them to input data and receive responses.

Equifax customers interacted with a web application that used a potentially vulnerable plugin.

When a customer interacts with the system, the plugin pulls information from a library program called XStream.

XStream converts customer data into a serial string of text characters (XML code) suitable for web requests and replies.

The XSteam code includes everything needed to build Java objects of almost any type.

This enabled hackers to insert their own code into Java objects and manipulate the server running XStream.