Version 6.7.0

Struts 2 Core

No description available.

Install Instructions

mvn install struts2-core
Language Java
Package URL (purl) pkg:maven/org.apache.struts:struts2-core@6.7.0

Find Struts 2 Core vulnerabilities in your supply chain.

Scan for Free

Struts 2 Core Vulnerabilities

Sort by
icon CVE (Latest)
  • icon CVE (Latest)
  • icon CVE (Oldest)
  • icon CVSS Score (Highest)
  • icon CVSS Score (Lowest)
CVE question mark icon CVSS Score question mark icon CWE(s) question mark icon EPSS Score question mark icon EPSS % question mark icon Impacted Versions
CVE-2008-6504 Medium 5 CWE-20 0.05674 0.93215
  • 2.0.5–2.1.2
CVE-2008-6505 Medium 5 CWE-22 0.96499 0.99728
  • 2.0.5–2.1.2
CVE-2008-6682 Medium 4.3 CWE-79 0.00385 0.72812
  • 2.0.5–2.0.11
CVE-2010-1870 Medium 5 CWE-94 0.25211 0.96682
  • 2.0.5–2.1.8.1
CVE-2011-1772 Low 2.6 CWE-79 0.01368 0.8596
  • 2.0.5–2.2.1.1
CVE-2011-2087 Medium 4.3 CWE-79 0.08658 0.94493
  • 2.0.5–2.2.1.1
CVE-2011-3923 High 9.8 CWE-94, CWE-732 0.94455 0.99409
  • 2.0.5–2.3.1.1
CVE-2011-5057 Medium 5 CWE-264 0.02284 0.89316
  • 2.0.5–2.3.1.2
CVE-2012-0391 High 9.3 CWE-20 0.16678 0.96007
  • 2.0.5–2.3.1
CVE-2012-0392 Medium 6.8 CWE-264 0.96307 0.99687
  • 2.0.5–2.3.1
CVE-2012-0393 Medium 6.4 CWE-264 0.87343 0.98883
  • 2.0.5–2.3.1
CVE-2012-0394 Medium 6.3 CWE-94 0.9489 0.99463
  • 2.0.5–2.3.1
CVE-2012-0838 High 10 CWE-20 0.25425 0.96691
  • 2.0.5–2.2.3
CVE-2012-1592 High 8.8 CWE-434 0.00397 0.73178
  • 2.0.5–2.5-BETA3
CVE-2012-4386 Medium 6.8 CWE-352 0.00327 0.70517
  • 2.0.5–2.3.4
CVE-2012-4387 Medium 5 CWE-264 0.03595 0.91509
  • 2.0.5–2.3.4
CVE-2013-0112 Unknown CWE-94 None None
  • 2.0.5–2.3.16.1
CVE-2013-1965 High 9.3 CWE-94 0.20077 0.96335
  • 2.0.5–2.3.14
CVE-2013-1966 High 9.3 CWE-94 0.4582 0.97492
  • 2.0.5–2.3.14.1
CVE-2013-2115 High 8.1 CWE-94 0.00659 0.79455
  • 2.0.5–2.3.14.1
CVE-2013-2134 High 9.3 CWE-94 0.95443 0.9954
  • 2.0.5–2.3.14.3
CVE-2013-2135 High 9.3 CWE-94 0.92977 0.99269
  • 2.0.5–2.3.14.2
CVE-2013-2248 Medium 5.8 CWE-20, CWE-601 0.96779 0.99789
  • 2.0.5–2.3.15
CVE-2013-2251 High 9.8 CWE-20, CWE-74, CWE-94 0.97042 0.99862
  • 2.0.5–2.3.15
CVE-2013-4310 Medium 5.8 CWE-264 0.02548 0.8988
  • 2.0.5–2.3.15.2
CVE-2013-4316 High 10 CWE-284, CWE-16 0.02255 0.89236
  • 2.0.5–2.3.15
CVE-2013-6348 Medium 4.3 CWE-79 0.00791 0.81346
  • 2.0.5–2.3.15.3
CVE-2014-0094 Medium 5 CWE-94 0.96676 0.99767
  • 2.0.5–2.3.16.1
CVE-2014-0112 High 7.5 CWE-264 0.97176 0.999
  • 2.0.5–2.3.16.3
CVE-2014-0113 High 7.5 CWE-264 0.92485 0.99221
  • 2.0.5–2.3.16.3
CVE-2014-0116 Medium 5.8 CWE-264 0.01726 0.87532
  • 2.0.5–2.3.16.3
CVE-2014-7809 Medium 6.8 CWE-352 0.0023 0.60711
  • 2.0.5–2.3.16.3
CVE-2015-1831 High 7.5 CWE-453 0.01276 0.8544
  • 2.0.5–2.3.20
CVE-2015-2992 Medium 6.1 CWE-79 0.00574 0.77804
  • 2.0.5–2.3.16.3
CVE-2015-5169 Medium 6.1 CWE-79 0.00381 0.72662
  • 2.0.5–2.3.16.3
CVE-2015-5209 High 7.5 CWE-20, CWE-284 0.04211 0.92144
  • 2.0.5–2.3.24
CVE-2016-0785 High 8.8 CWE-20 0.09535 0.94751
  • 2.0.5–2.3.24.1
CVE-2016-2162 Medium 6.1 CWE-79 0.19232 0.96264
  • 2.0.5–2.3.24.3
CVE-2016-3081 High 8.1 CWE-77 0.97503 0.9999
  • 2.0.5–2.3.28
CVE-2016-3082 High 9.8 CWE-20 0.76551 0.98403
  • 2.0.5–2.3.28
CVE-2016-3090 High 8.8 CWE-20 0.06694 0.93747
  • 2.0.5–2.3.16.3
CVE-2016-3093 Medium 5.3 CWE-20 0.06396 0.9361
  • 2.0.5–2.3.24.1
CVE-2016-4003 Medium 6.1 CWE-79 0.11551 0.9522
  • 2.0.5–2.3.24.3
CVE-2016-4436 High 9.8 0.04012 0.91967
  • 2.0.5–2.5
CVE-2016-4461 High 8.8 CWE-20 0.08782 0.94542
  • 2.0.5–2.3.28.1
CVE-2017-12611 High 9.8 CWE-20, CWE-502 0.9707 0.99872
  • 2.0.5–2.5.10.1
CVE-2017-9791 High 9.8 CWE-20 0.97508 0.99991
  • 2.0.5–2.3.32
CVE-2017-9793 High 7.5 CWE-20, CWE-400 0.9133 0.9913
  • 2.0.5–2.5-BETA3
CVE-2018-11776 High 8.1 CWE-20 0.97398 0.99963
  • 2.0.5–2.5-BETA3
CVE-2018-1327 High 7.5 CWE-20 0.00862 0.82076
  • 2.0.5–2.5-BETA3
CVE-2019-0230 High 9.8 CWE-915, CWE-1321 0.95694 0.99573
  • 2.0.5–2.5-BETA3
CVE-2019-0233 High 7.5 CWE-281 0.15603 0.95879
  • 2.0.5–2.5-BETA3
CVE-2020-17530 High 9.8 CWE-94, CWE-917 0.96792 0.99793
  • 2.0.5–2.5-BETA3
CVE-2021-31805 High 9.8 CWE-917 0.90012 0.99046
  • 2.0.5–2.5-BETA3
CVE-2023-34149 Medium 6.5 CWE-770 0.03139 0.90885
  • 6.0.0–6.1.2
  • 2.0.5–2.5-BETA3
CVE-2023-34396 High 7.5 CWE-770 0.01467 0.86445
  • 6.0.0–6.1.2
  • 2.0.5–2.5-BETA3
CVE-2023-41835 High 7.5 CWE-459, CWE-913 0.0039 0.72977
  • 6.0.0–6.3.0
  • 2.0.5–2.5-BETA3
CVE-2023-50164 High 9.8 CWE-552 0.53311 0.97724
  • 6.0.0–6.3.0
  • 2.0.5–2.5-BETA3
CVE-2024-53677 Unknown CWE-434 0.00043 0.10859
  • 6.0.0–6.3.0.2
  • 2.0.5–2.5-BETA3
CVE-2007-6726 Medium 4.3 CWE-79 0.00565 0.7764
  • 2.0.9
CVE-2011-2088 Medium 5.3 CWE-200 0.0044 0.74489
  • 2.2.1
CVE-2017-9805 High 8.1 CWE-20, CWE-502 0.97393 0.99963
  • 2.1.6–2.5.12
CVE-2017-5638 High 9.8 CWE-20, CWE-755, CWE-94 0.9586 0.99601
  • 2.3.1–2.5.10
CVE-2017-15707 Medium 6.2 CWE-20, CWE-400 0.00599 0.78267
  • 2.5–2.5-BETA3
CVE-2017-9787 High 7.5 CWE-284, CWE-400 0.02164 0.88991
  • 2.3.7–2.5.10.1
CVE-2017-9804 High 7.5 CWE-20, CWE-399, CWE-400 0.0595 0.9336
  • 2.3.7–2.5.12
CVE-2016-4430 High 8.8 CWE-352 0.06441 0.93627
  • 2.3.20–2.3.28.1
CVE-2016-4431 High 7.5 CWE-20 0.09199 0.94663
  • 2.3.20–2.5-BETA3
CVE-2016-4433 High 7.5 CWE-20 0.056 0.93169
  • 2.3.20–2.3.28.1
CVE-2016-4438 High 9.8 CWE-20 0.53775 0.97733
  • 2.3.20–2.3.28.1
CVE-2016-4465 Medium 5.3 CWE-20 0.81575 0.98597
  • 2.3.20–2.5.12
CVE-2016-6795 High 9.8 CWE-22, CWE-94 0.023 0.89363
  • 2.3.20–2.5.2
CVE-2016-8738 Medium 5.9 CWE-20, CWE-400 0.00662 0.79521
  • 2.5–2.5.12
CVE-2017-7672 Medium 5.9 CWE-20, CWE-400 0.03279 0.91105
  • 2.5–2.5.10.1
CVE-2016-3087 High 9.8 CWE-20 0.64557 0.98042
  • 2.3.20–2.3.28

Struts 2 Core Vulnerability Remediation Guidance

CVE Description Full list of Impacted Versions Fix
CVE-2024-53677 File upload logic is flawed vulnerability in Apache Struts. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2023-50164 An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2023-41835 When a Multipart request is performed but some of the fields exceed the maxStringLength  limit, the upload files will remain in struts.multipart.saveDir  even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2023-34396 Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2023-34149 Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2021-31805 The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2020-17530 Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2019-0233 An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2019-0230 Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2018-1327 The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2018-11776 Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2017-9805 The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads. 2.2.1, 2.3.1, 2.3.1.2, 2.2.3.1, 2.2.1.1, 2.1.8, 2.2.3, 2.1.6 (Show all) Major → 6.4.0
CVE-2017-9804 In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672. 2.3.14, 2.3.24.3, 2.5, 2.3.29, 2.3.20.1, 2.3.16.2, 2.3.15, 2.3.8 (Show all) Major → 6.4.0
CVE-2017-9793 The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2017-9791 The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2017-9787 When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33. 2.3.14, 2.3.24.3, 2.5, 2.3.29, 2.3.20.1, 2.3.16.2, 2.3.15, 2.3.8 (Show all) Major → 6.4.0
CVE-2017-7672 If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12. 2.5, 2.5.10.1, 2.5.1, 2.5.10, 2.5.2, 2.5.5, 2.5.8 Patch → 6.4.0
CVE-2017-5638 The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string. 2.3.1, 2.3.1.2, 2.3.1.1, 2.3.14, 2.3.24.3, 2.5, 2.3.29, 2.3.20.1 (Show all) Major → 6.4.0
CVE-2017-15707 In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload. 2.5.13, 2.5, 2.5-BETA3, 2.5-BETA1, 2.5.12, 2.5-BETA2, 2.5.10.1, 2.5.14 (Show all) Major → 6.4.0
CVE-2017-12611 In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2016-8738 In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. 2.5, 2.5.12, 2.5.10.1, 2.5.1, 2.5.10, 2.5.2, 2.5.5, 2.5.8 Patch → 6.4.0
CVE-2016-6795 In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side. 2.3.24.3, 2.5, 2.3.29, 2.3.20.1, 2.3.24.1, 2.3.30, 2.3.20, 2.3.28 (Show all) Patch → 6.4.0
CVE-2016-4465 The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field. 2.3.24.3, 2.5, 2.3.20.1, 2.3.24.1, 2.3.20, 2.3.28, 2.5.12, 2.5.10.1 (Show all) Patch → 6.4.0
CVE-2016-4461 Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2016-4438 The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression. 2.3.24.3, 2.3.20.1, 2.3.24.1, 2.3.20, 2.3.28, 2.3.20.3, 2.3.24, 2.3.28.1 Patch → 6.4.0
CVE-2016-4436 Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2016-4433 Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request. 2.3.24.3, 2.3.20.1, 2.3.24.1, 2.3.20, 2.3.28, 2.3.20.3, 2.3.24, 2.3.28.1 Patch → 6.4.0
CVE-2016-4431 Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method. 2.3.24.3, 2.5-BETA3, 2.5-BETA1, 2.3.20.1, 2.3.24.1, 2.3.20, 2.3.28, 2.5-BETA2 (Show all) Patch → 6.4.0
CVE-2016-4430 Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors. 2.3.24.3, 2.3.20.1, 2.3.24.1, 2.3.20, 2.3.28, 2.3.20.3, 2.3.24, 2.3.28.1 Patch → 6.4.0
CVE-2016-4003 Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2016-3093 Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2016-3090 The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2016-3087 Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin. 2.3.20.1, 2.3.24.1, 2.3.20, 2.3.28, 2.3.24 Patch → 6.4.0
CVE-2016-3082 XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2016-3081 Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2016-2162 Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2016-0785 Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2015-5209 Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2015-5169 Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2015-2992 Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2015-1831 The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2014-7809 Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protection mechanism. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2014-0116 CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2014-0113 CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2014-0112 ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2014-0094 The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2013-6348 Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2013-4316 Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2013-4310 Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2013-2251 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2013-2248 Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2013-2135 Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2013-2134 Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2013-2115 Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2013-1966 Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2013-1965 Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2013-0112 None 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2012-4387 Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2012-4386 The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2012-1592 A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2012-0838 Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2012-0394 ** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself." 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2012-0393 The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2012-0392 The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2012-0391 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2011-5057 Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces. NOTE: the vendor disputes the significance of this report because of an "easy work-around in existing apps by configuring the interceptor." 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2011-3923 Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2011-2088 XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3. 2.2.1 Major → 6.4.0
CVE-2011-2087 Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2011-1772 Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2010-1870 The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 (Show all) Major → 6.4.0
CVE-2008-6682 Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag. 2.0.11, 2.0.5, 2.0.9, 2.0.8, 2.0.6 Major → 6.4.0
CVE-2008-6505 Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 Major → 6.4.0
CVE-2008-6504 ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character. 2.0.11, 2.0.11.1, 2.0.5, 2.0.11.2, 2.1.2, 2.0.9, 2.0.8, 2.0.6 Major → 6.4.0
CVE-2007-6726 Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/. 2.0.9 Major → 6.4.0

Instantly see if these Struts 2 Core vulnerabilities affect your code.

Scan for Free

Dependencies

Packages using versions of Struts 2 Core affected by its vulnerabilities

Dependent Packages
org.freemarker:freemarker:
com.github.ben-manes.caffeine:caffeine:
javax.servlet:javax.servlet-api:
javax.servlet.jsp:jsp-api:
ognl:ognl:
org.apache.logging.log4j:log4j-api:
commons-fileupload:commons-fileupload:
commons-io:commons-io:
org.apache.commons:commons-lang3:
org.apache.commons:commons-text:
org.hibernate:hibernate-core:5.6.15.Final
org.springframework:spring-test:
org.springframework:spring-web:
org.springframework:spring-context:
org.springframework:spring-context-support:
org.awaitility:awaitility:
junit:junit:
org.apache.logging.log4j:log4j-core:
org.apache.commons:commons-collections4:
mockobjects:mockobjects-jdk1.3:
mockobjects:mockobjects-alt-jdk1.3:
mockobjects:mockobjects-alt-jdk1.3-j2ee1.3:
mockobjects:mockobjects-jdk1.3-j2ee1.3:
jmock:jmock:
org.mockito:mockito-core:
org.assertj:assertj-core:
mockobjects:mockobjects-core:
org.easymock:easymock:
org.apache.struts:struts-annotations:
org.testng:testng:
org.slf4j:slf4j-api:
org.slf4j:slf4j-simple:
commons-validator:commons-validator: