# org.apache.struts.xwork:xwork-core (Maven) vulnerabilities 16 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.3.37 (Dec 30, 2018): affected by CVE-2025-68493 - Newest unaffected release: Every release is affected by at least one advisory - Dependents: 80 - Releases: 42 since 2.2.1 (Jul 17, 2010) - Registry: https://central.sonatype.com/artifact/org.apache.struts.xwork/xwork-core - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2025-68493: 2.2.1 to 2.3.37 (through the newest release) - CVE-2016-4433: 2.3.20 to 2.3.28.1 (2.3.29 is outside it) - CVE-2016-4430: 2.3.20 to 2.3.28.1 (2.3.29 is outside it) - CVE-2015-1831: 2.2.1 to 2.3.20 (2.3.20.1 is outside it) - CVE-2014-0094: 2.2.1 to 2.3.16.1 (2.3.16.2 is outside it) - CVE-2013-2135: 2.2.1 to 2.3.14.2 (2.3.14.3 is outside it) - CVE-2013-2134: 2.2.1 to 2.3.14.2 (2.3.14.3 is outside it) - CVE-2013-2115: 2.2.1 to 2.3.14.1 (2.3.14.2 is outside it) - CVE-2013-1966: 2.2.1 to 2.3.14.1 (2.3.14.2 is outside it) - CVE-2012-4387: 2.2.1 to 2.3.4 (2.3.4.1 is outside it) - CVE-2012-0838: 2.2.1 to 2.2.3 (2.2.3.1 is outside it) - CVE-2012-0394: 2.2.1 to 2.3.16.3 (2.3.20 is outside it) - CVE-2012-0393: 2.2.1 to 2.2.3 (2.2.3.1 is outside it) - CVE-2012-0392: 2.2.1 to 2.2.3 (2.2.3.1 is outside it) - CVE-2012-0391: 2.2.1 to 2.2.3 (2.2.3.1 is outside it) - CVE-2011-2088: 2.2.1 to 2.2.1.1 (2.2.3 is outside it) ## Advisories (16) ### [CVE-2025-68493](https://cve.now/CVE-2025-68493): Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component - Severity: High 8.1 - Published: Jan 11, 2026 - Affected: from 2.2.1, through 6.1.0; from 2.2.1. - No fix released. The latest release, 2.3.37, is still affected. ### [CVE-2016-4433](https://cve.now/CVE-2016-4433): Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via… - Severity: Unrated - Published: Jul 4, 2016 - Affected: from 2.3.20, fixed in 2.3.29. - Fixed in 2.3.29 (released Jun 14, 2016, 20 days before disclosure). - The latest release, 2.3.37, is not affected. ### [CVE-2016-4430](https://cve.now/CVE-2016-4430): Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery… - Severity: Unrated - Published: Jul 4, 2016 - Affected: from 2.3.20, fixed in 2.3.29. - Fixed in 2.3.29 (released Jun 14, 2016, 20 days before disclosure). - The latest release, 2.3.37, is not affected. ### [CVE-2015-1831](https://cve.now/CVE-2015-1831): The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an… - Severity: Unrated - Published: Jul 16, 2015 - Affected: from 2.0.0, fixed in 2.3.20.1. - Fixed in 2.3.20.1 (released May 6, 2015, 71 days before disclosure). - The latest release, 2.3.37, is not affected. ### [CVE-2014-0094](https://cve.now/CVE-2014-0094): The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class… - Severity: Unrated - Published: Mar 10, 2014 - Affected: from 2.0.0, fixed in 2.3.16.2. - Fixed in 2.3.16.2 (released Apr 24, 2014, 45 days after disclosure). - The latest release, 2.3.37, is not affected. ### [CVE-2013-2135](https://cve.now/CVE-2013-2135): Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains… - Severity: Unrated - Published: Jul 16, 2013 - Affected: from 2.0.0, fixed in 2.3.14.3. - Fixed in 2.3.14.3 (released Jun 3, 2013, 43 days before disclosure). - The latest release, 2.3.37, is not affected. ### [CVE-2013-2134](https://cve.now/CVE-2013-2134): Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is… - Severity: Unrated - Published: Jul 16, 2013 - Affected: from 2.0.0, fixed in 2.3.14.3. - Fixed in 2.3.14.3 (released Jun 3, 2013, 43 days before disclosure). - The latest release, 2.3.37, is not affected. ### [CVE-2013-2115](https://cve.now/CVE-2013-2115): Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled… - Severity: Unrated - Published: Jul 10, 2013 - Affected: from 2.0.0, fixed in 2.3.14.2. - Fixed in 2.3.14.2 (released May 24, 2013, 47 days before disclosure). - The latest release, 2.3.37, is not affected. ### [CVE-2013-1966](https://cve.now/CVE-2013-1966): Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled… - Severity: Unrated - Published: Jul 10, 2013 - Affected: from 2.0.0, fixed in 2.3.14.2. - Fixed in 2.3.14.2 (released May 24, 2013, 47 days before disclosure). - The latest release, 2.3.37, is not affected. ### [CVE-2012-4387](https://cve.now/CVE-2012-4387): Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which… - Severity: Unrated - Published: Sep 5, 2012 - Affected: from 2.0.0, fixed in 2.3.4.1. - Fixed in 2.3.4.1 (released Aug 3, 2012, 33 days before disclosure). - The latest release, 2.3.37, is not affected. ### [CVE-2012-0838](https://cve.now/CVE-2012-0838): Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote… - Severity: Unrated - Published: Mar 2, 2012 - Affected: fixed in 2.2.3.1. - Fixed in 2.2.3.1 (released Sep 5, 2011, 179 days before disclosure). - The latest release, 2.3.37, is not affected. ### [CVE-2012-0394](https://cve.now/CVE-2012-0394): The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute… - Severity: Unrated - Published: Jan 8, 2012 - Affected: fixed in 2.3.18. - Fixed in 2.3.20 (released Nov 21, 2014, 1048 days after disclosure, the advisory names 2.3.18, which was never published). - The latest release, 2.3.37, is not affected. ### [CVE-2012-0393](https://cve.now/CVE-2012-0393): The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote… - Severity: Unrated - Published: Jan 8, 2012 - Affected: fixed in 2.2.3.1. - Fixed in 2.2.3.1 (released Sep 5, 2011, 125 days before disclosure). - The latest release, 2.3.37, is not affected. ### [CVE-2012-0392](https://cve.now/CVE-2012-0392): The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers… - Severity: Unrated - Published: Jan 8, 2012 - Affected: fixed in 2.2.3.1. - Fixed in 2.2.3.1 (released Sep 5, 2011, 125 days before disclosure). - The latest release, 2.3.37, is not affected. ### [CVE-2012-0391](https://cve.now/CVE-2012-0391): The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception ha - Severity: Critical 9.8 · KEV - Published: Jan 8, 2012 - Affected: fixed in 2.2.3.1. - Fixed in 2.2.3.1 (released Sep 5, 2011, 125 days before disclosure). - The latest release, 2.3.37, is not affected. ### [CVE-2011-2088](https://cve.now/CVE-2011-2088): XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially… - Severity: Unrated - Published: May 13, 2011 - Affected: fixed in 2.2.2. - Fixed in 2.2.3 (released Apr 8, 2011, 35 days before disclosure, the advisory names 2.2.2, which was never published). - The latest release, 2.3.37, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.struts.xwork:xwork-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.