Apache Struts vulnerabilities and back-to-back releases/security announcements S2-022/2014-0116/S2-020 have been released. These vulnerabilities let an attacker get to the internal properties of Struts. Exploit works by modifying the naming scheme of log files and the location where log files are stored to root directory, where Web application code is stored. When the attacker sends a request containing malicious script, this will get logged into the log file, which may have a name and extension of the attackers choice.”]