Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.struts.xwork:xwork-core

16 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
2.3.37 (Dec 30, 2018): affected by CVE-2025-68493
Newest unaffected release
Every release is affected by at least one advisory
Advisories
16 · 1 critical, 1 high
Dependents
80
Releases
42 since 2.2.1 (Jul 17, 2010)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

Show all 16 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 16

  • Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component

    Affected: from 2.2.1, through 6.1.0; from 2.2.1.

    No fix released. The latest release, 2.3.37, is still affected.

  • Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via…

    Affected: from 2.3.20, fixed in 2.3.29.

    Fixed in 2.3.29 (released Jun 14, 2016, 20 days before disclosure).

    The latest release, 2.3.37, is not affected.

  • Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery…

    Affected: from 2.3.20, fixed in 2.3.29.

    Fixed in 2.3.29 (released Jun 14, 2016, 20 days before disclosure).

    The latest release, 2.3.37, is not affected.

  • The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an…

    Affected: from 2.0.0, fixed in 2.3.20.1.

    Fixed in 2.3.20.1 (released May 6, 2015, 71 days before disclosure).

    The latest release, 2.3.37, is not affected.

  • The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class…

    Affected: from 2.0.0, fixed in 2.3.16.2.

    Fixed in 2.3.16.2 (released Apr 24, 2014, 45 days after disclosure).

    The latest release, 2.3.37, is not affected.

  • Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains…

    Affected: from 2.0.0, fixed in 2.3.14.3.

    Fixed in 2.3.14.3 (released Jun 3, 2013, 43 days before disclosure).

    The latest release, 2.3.37, is not affected.

  • Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is…

    Affected: from 2.0.0, fixed in 2.3.14.3.

    Fixed in 2.3.14.3 (released Jun 3, 2013, 43 days before disclosure).

    The latest release, 2.3.37, is not affected.

  • Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled…

    Affected: from 2.0.0, fixed in 2.3.14.2.

    Fixed in 2.3.14.2 (released May 24, 2013, 47 days before disclosure).

    The latest release, 2.3.37, is not affected.

  • Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled…

    Affected: from 2.0.0, fixed in 2.3.14.2.

    Fixed in 2.3.14.2 (released May 24, 2013, 47 days before disclosure).

    The latest release, 2.3.37, is not affected.

  • Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which…

    Affected: from 2.0.0, fixed in 2.3.4.1.

    Fixed in 2.3.4.1 (released Aug 3, 2012, 33 days before disclosure).

    The latest release, 2.3.37, is not affected.

  • Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote…

    Affected: fixed in 2.2.3.1.

    Fixed in 2.2.3.1 (released Sep 5, 2011, 179 days before disclosure).

    The latest release, 2.3.37, is not affected.

  • The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute…

    Affected: fixed in 2.3.18.

    Fixed in 2.3.20 (released Nov 21, 2014, 1048 days after disclosure, the advisory names 2.3.18, which was never published).

    The latest release, 2.3.37, is not affected.

  • The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote…

    Affected: fixed in 2.2.3.1.

    Fixed in 2.2.3.1 (released Sep 5, 2011, 125 days before disclosure).

    The latest release, 2.3.37, is not affected.

  • The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers…

    Affected: fixed in 2.2.3.1.

    Fixed in 2.2.3.1 (released Sep 5, 2011, 125 days before disclosure).

    The latest release, 2.3.37, is not affected.

  • CVE-2012-0391Critical 9.8 · KEV

    The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception ha

    Affected: fixed in 2.2.3.1.

    Fixed in 2.2.3.1 (released Sep 5, 2011, 125 days before disclosure).

    The latest release, 2.3.37, is not affected.

  • XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially…

    Affected: fixed in 2.2.2.

    Fixed in 2.2.3 (released Apr 8, 2011, 35 days before disclosure, the advisory names 2.2.2, which was never published).

    The latest release, 2.3.37, is not affected.