Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 101

Export CSV
CVE-2012-0393

struts: remote creation or overwrite of arbitrary files due ParamterInterceptor not preventing access to public constructors

The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.

CVSS 2.0 · 6.4 Medium EPSS 36.3% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2012-0392

struts: arbitrary command execution via crafted HTTP Cookie header

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

CVSS 2.0 · 6.8 Medium EPSS 97.5% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2011-5057

struts: improper access restrictions to collections such as session and request

Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces. NOTE: the vendor disputes the significance of this report because of an "easy work-around in existing apps by configuring the interceptor."

CVSS 2.0 · 5.0 Medium EPSS 27.2% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2011-2088

struts: Allows remote attackers to obtain potentially sensitive information via vectors involving an s:submit element

XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.

CVSS 2.0 · 5.0 Medium EPSS 6.1% KEV · Not listed
Vendors
Apache Opensymphony
Products
Struts Webwork Xwork
CVE-2011-2087

struts: Multiple XSS flaws in component handlers in javatemplates plug-in

Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.

CVSS 2.0 · 4.3 Medium EPSS 6.1% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2011-1772

struts: Multiple XSS flaws in XWork

Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.

CVSS 2.0 · 2.6 Low EPSS 33.3% KEV · Not listed
Vendors
Apache Opensymphony
Products
Struts Webwork Xwork
CVE-2013-2115

struts2: remote command execution due to flaw in the includeParams attribute of URL and Anchor tags

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.

CVSS 3.1 · 8.1 High EPSS 74.6% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2013-1966

struts2: remote command execution due to flaw in the includeParams attribute of URL and Anchor tags

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.

CVSS 2.0 · 9.3 Critical EPSS 73.7% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2013-1965

struts2: remote command execution in Showcase app

Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.

CVSS 2.0 · 9.3 Critical EPSS 93.5% KEV · Not listed
Vendors
Apache
Products
Struts Struts2-showcase
CVE-2012-4387

struts2: Long parameter name DoS

Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.

CVSS 2.0 · 5.0 Medium EPSS 8.1% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2012-4386

struts2: CSRF protection bypass

The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.

CVSS 2.0 · 6.8 Medium EPSS 3.4% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2023-50164

Apache Struts: File upload component had a directory traversal vulnerability

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

CVSS 3.1 · 9.8 Critical EPSS 80.8% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2023-34396

Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms

Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater

CVSS 3.1 · 4.3 Medium EPSS 5.5% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2023-34149

Apache Struts: DoS via OOM owing to not properly checking of list bounds

Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater.

CVSS 3.1 · 4.3 Medium EPSS 5.4% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2021-31805

Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.

CVSS 3.1 · 9.8 Critical EPSS 85.4% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2018-1327

struts: Denial-of-Service attack via crafted XML request using Struts REST plugin

The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.

CVSS 3.0 · 7.5 High EPSS 8.6% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2015-2992

struts: XSS vulnerability when JSP files are exposed to be accessed directly

Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.

CVSS 3.1 · 6.1 Medium EPSS 5.8% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2012-1592

struts2: xsltResult local code execution flaw

A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.

CVSS 3.1 · 8.8 High EPSS 28.5% KEV · Not listed
Vendors
Apache
Products
Struts