Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

com.opensymphony:xwork

2 known vulnerabilities (1 high), with the versions each affects and the releases that fix them.

Latest release
2.1.3 (Apr 24, 2009): affected by CVE-2025-68493
Newest unaffected release
Every release is affected by at least one advisory
Advisories
2 · 1 high
Dependents
16
Releases
8 since 2.0.4 (Jul 19, 2007)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2025-68493
    Affects 2.0.4 to 2.1.3 (through the newest release)
  • CVE-2008-6504
    Affects 2.0.4 to 2.0.5 (2.0.6 is outside it); 2.1.0 to 2.1.1 (2.1.2 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component

    Affected: from 2.0.0, fixed in 2.2.1; from 2.0.0.

    No fix released. The latest release, 2.1.3, is still affected.

  • ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does…

    Affected: fixed in 2.0.6; from 2.1.0, fixed in 2.1.2.

    Fixed in 2.0.6 (released Oct 14, 2008, 160 days before disclosure) and 2.1.2 (released Dec 21, 2008, 92 days before disclosure).

    The latest release, 2.1.3, is not affected.