- Latest release
- 7.4.0 (Sep 17, 2026): affected by CVE-2025-66675
- Newest unaffected release
- Every release is affected by at least one advisory
- Advisories
- 60 · 6 critical, 6 high, 2 medium
- Dependents
- 25
- Releases
- 112 since 2.0.5 (Feb 10, 2007)
- Registry
- Maven Central
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2025-68493Affects 2.0.5 to 2.3.37 (2.5-BETA1 is outside it); 2.5 to 6.0.3 (6.1.1 is outside it)
- CVE-2025-66675Affects 2.0.5 to 7.4.0 (through the newest release)
- CVE-2025-64775Affects 2.0.5 to 6.7.4 (6.8.0 is outside it); 7.0.0 to 7.0.3 (7.1.1 is outside it)
- CVE-2024-53677Affects 2.0.5 to 6.3.0.2 (6.4.0 is outside it)
- CVE-2023-50164Affects 2.0.5 to 2.5.32 (2.5.33 is outside it); 6.0.0 to 6.3.0.1 (6.3.0.2 is outside it)
- CVE-2023-41835Affects 2.0.5 to 2.5.31 (2.5.32 is outside it); 6.0.0 to 6.1.2.1 (6.1.2.2 is outside it); 6.2.0 to 6.3.0 (6.3.0.1 is outside it)
- CVE-2023-34396Affects 2.0.5 to 2.5.30 (2.5.31 is outside it); 6.0.0 to 6.1.2 (6.1.2.1 is outside it)
- CVE-2023-34149Affects 2.0.5 to 2.5.30 (2.5.31 is outside it); 6.0.0 to 6.1.2 (6.1.2.1 is outside it)
- CVE-2021-31805Affects 2.0.5 to 2.5.29 (2.5.30 is outside it)
- CVE-2020-17530Affects 2.0.5 to 2.5.25 (2.5.26 is outside it)
- CVE-2019-0233Affects 2.0.5 to 2.5.20 (2.5.22 is outside it)
- CVE-2019-0230Affects 2.0.5 to 2.5.20 (2.5.22 is outside it)
Show all 60 advisoriesShow fewer advisories
- CVE-2015-2992Affects 2.0.5 to 2.3.16.3 (2.3.20 is outside it)
- CVE-2012-1592Affects 2.0.5 to 2.5.20 (2.5.22 is outside it)
- CVE-2011-3923Affects 2.0.5 to 2.3.1.1 (2.3.1.2 is outside it)
- CVE-2018-11776Affects 2.0.5 to 2.3.34 (2.3.35 is outside it); 2.5 to 2.5.16 (2.5.17 is outside it)
- CVE-2016-4461Affects 2.0.5 to 2.3.28.1 (2.3.29 is outside it)
- CVE-2015-5169Affects 2.0.5 to 2.3.16.3 (2.3.20 is outside it)
- CVE-2017-9804Affects 2.3.7 to 2.3.33 (2.3.34 is outside it); 2.5 to 2.5.12 (2.5.13 is outside it)
- CVE-2017-12611Affects 2.0.5 to 2.3.33 (2.3.34 is outside it); 2.5 to 2.5.10.1 (2.5.12 is outside it)
- CVE-2016-8738Affects 2.5 to 2.5.12 (2.5.13 is outside it)
- CVE-2015-5209Affects 2.0.5 to 2.3.24 (2.3.24.1 is outside it)
- CVE-2017-9787Affects 2.3.7 to 2.3.32 (2.3.33 is outside it); 2.5 to 2.5.10.1 (2.5.12 is outside it)
- CVE-2017-7672Affects 2.5 to 2.5.10.1 (2.5.12 is outside it)
- CVE-2017-5638Affects 2.3.1 to 2.3.31 (2.3.32 is outside it); 2.5 to 2.5.10 (2.5.10.1 is outside it)
- CVE-2016-4436Affects 2.0.5 to 2.3.28.1 (2.3.29 is outside it); 2.5-BETA1 to 2.5 (2.5.1 is outside it)
- CVE-2016-4465Affects 2.3.20 to 2.3.28.1 (2.3.29 is outside it); 2.5 to 2.5.12 (2.5.13 is outside it)
- CVE-2016-4438Affects 2.3.20 to 2.3.28.1 (2.3.29 is outside it)
- CVE-2016-3093Affects 2.0.5 to 2.3.24.1 (2.3.24.3 is outside it)
- CVE-2016-3087Affects 2.3.20 to 2.3.20.1 (2.3.20.3 is outside it); 2.3.24 to 2.3.24.1 (2.3.24.3 is outside it); 2.3.28 (2.3.28.1 is outside it)
- CVE-2016-3082Affects 2.0.5 to 2.3.20.1 (2.3.20.3 is outside it); 2.3.24 to 2.3.24.1 (2.3.24.3 is outside it); 2.3.28 (2.3.28.1 is outside it)
- CVE-2016-3081Affects 2.3.20 to 2.3.20.1 (2.3.20.3 is outside it); 2.3.24 to 2.3.24.1 (2.3.24.3 is outside it); 2.3.28 (2.3.28.1 is outside it)
- CVE-2016-4003Affects 2.0.5 to 2.3.24.3 (2.3.28 is outside it)
- CVE-2016-2162Affects 2.0.5 to 2.3.24.3 (2.3.28 is outside it)
- CVE-2016-0785Affects 2.0.5 to 2.3.20.1 (2.3.20.3 is outside it); 2.3.24 to 2.3.24.1 (2.3.24.3 is outside it)
- CVE-2015-1831Affects 2.0.5 to 2.3.20 (2.3.20.1 is outside it)
- CVE-2014-7809Affects 2.0.5 to 2.3.16.3 (2.3.20 is outside it)
- CVE-2014-0116Affects 2.0.5 to 2.3.16.3 (2.3.20 is outside it)
- CVE-2014-0113Affects 2.0.5 to 2.3.16.3 (2.3.20 is outside it)
- CVE-2014-0112Affects 2.0.5 to 2.3.16.3 (2.3.20 is outside it)
- CVE-2014-0094Affects 2.0.5 to 2.3.16.1 (2.3.16.2 is outside it)
- CVE-2013-6348Affects 2.0.5 to 2.3.15.3 (2.3.16 is outside it)
- CVE-2013-4316Affects 2.0.5 to 2.3.15.1 (2.3.15.2 is outside it)
- CVE-2013-4310Affects 2.0.5 to 2.3.15.2 (2.3.15.3 is outside it)
- CVE-2013-2251Affects 2.0.5 to 2.3.15 (2.3.15.1 is outside it)
- CVE-2013-2248Affects 2.0.5 to 2.3.15 (2.3.15.1 is outside it)
- CVE-2013-2135Affects 2.0.5 to 2.3.14.2 (2.3.14.3 is outside it)
- CVE-2013-2134Affects 2.0.5 to 2.3.14.2 (2.3.14.3 is outside it)
- CVE-2013-2115Affects 2.0.5 to 2.3.14.1 (2.3.14.2 is outside it)
- CVE-2013-1966Affects 2.0.5 to 2.3.14.1 (2.3.14.2 is outside it)
- CVE-2013-1965Affects 2.0.5 to 2.3.14.2 (2.3.14.3 is outside it)
- CVE-2012-4386Affects 2.0.5 to 2.3.4 (2.3.4.1 is outside it)
- CVE-2012-0838Affects 2.0.5 to 2.2.3 (2.2.3.1 is outside it)
- CVE-2012-0393Affects 2.0.5 to 2.3.1 (2.3.1.1 is outside it)
- CVE-2012-0392Affects 2.0.5 to 2.2.3 (2.2.3.1 is outside it)
- CVE-2012-0391Affects 2.0.5 to 2.2.3 (2.2.3.1 is outside it)
- CVE-2011-1772Affects 2.0.5 to 2.2.1.1 (2.2.3 is outside it)
- CVE-2010-1870Affects 2.0.5 to 2.1.8.1 (2.2.1 is outside it)
- CVE-2008-6682Affects 2.0.5 to 2.0.11 (2.0.11.1 is outside it)
- CVE-2008-6505Affects 2.0.5 to 2.0.11.2 (2.0.12 is outside it); 2.1.2 (2.1.6 is outside it)
Advisories 60
- CVE-2025-68493High 8.1
Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component
Affected: from 2.0.0, through 2.3.37; from 2.5.0, through 2.5.33; from 6.0.0, fixed in 6.1.1.
Fixed in 6.1.1 (released Nov 15, 2022, 1153 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2025-66675High 8.2
Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed
Affected: from 2.0.0; from 7.0.0; from 2.0.0, fixed in 6.8.0; from 7.0.0, fixed in 7.1.1.
No fix released. The latest release, 7.4.0, is still affected.
- CVE-2025-64775High 7.5
Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)
Affected: from 2.0.0, through 6.7.0; from 7.0.0, through 7.0.3; from 6.0.0, fixed in 6.8.0; from 7.0.0, fixed in 7.1.1; from 2.0.0, through 2.3.37; from 2.5.0, through 2.5.33.
Fixed in 6.8.0 (released Sep 15, 2025, 77 days before disclosure) and 7.1.1 (released Oct 1, 2025, 61 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2024-53677Critical 9.5
Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
Affected: from 2.0.0, fixed in 6.4.0; fixed in 6.4.0.
Fixed in 6.4.0 (released Apr 7, 2024, 248 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2023-50164Critical
Apache Struts: File upload component had a directory traversal vulnerability
Affected: from 2.0.0, fixed in 2.5.33; from 6.0.0, fixed in 6.3.0.2.
Fixed in 2.5.33 (released Dec 5, 2023, 2 days before disclosure) and 6.3.0.2 (released Dec 5, 2023, 2 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2023-41835High 7.5
Apache Struts: excessive disk usage
Affected: from 6.2.0, fixed in 6.3.0.1; from 6.0.0, fixed in 6.1.2.2; fixed in 2.5.32.
Fixed in 2.5.32 (released Sep 11, 2023, 85 days before disclosure), 6.1.2.2 (released Sep 11, 2023, 85 days before disclosure) and 6.3.0.1 (released Sep 11, 2023, 85 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2023-34396Medium 4.3
Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms
Affected: fixed in 2.5.31; from 6.0.0, fixed in 6.1.2.1.
Fixed in 2.5.31 (released Jun 13, 2023, 1 day before disclosure) and 6.1.2.1 (released Jun 13, 2023, 1 day before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2023-34149Medium 4.3
Apache Struts: DoS via OOM owing to not properly checking of list bounds
Affected: fixed in 2.5.31; from 6.0.0, fixed in 6.1.2.1.
Fixed in 2.5.31 (released Jun 13, 2023, 1 day before disclosure) and 6.1.2.1 (released Jun 13, 2023, 1 day before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2021-31805Unrated
Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.
Affected: from 2.0.0, fixed in 2.5.30.
Fixed in 2.5.30 (released Mar 15, 2022, 28 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2020-17530Critical 9.8 · KEV
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
Affected: from 2.0.0, fixed in 2.5.26.
Fixed in 2.5.26 (released Nov 25, 2020, 16 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2019-0233Unrated
An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.
Affected: from 2.0.0, fixed in 2.5.22.
Fixed in 2.5.22 (released Nov 17, 2019, 302 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2019-0230Unrated
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code…
Affected: from 2.0.0, fixed in 2.5.22.
Fixed in 2.5.22 (released Nov 17, 2019, 302 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2015-2992Unrated
Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
Affected: fixed in 2.3.20.
Fixed in 2.3.20 (released Nov 21, 2014, 1924 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2012-1592Unrated
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and…
Affected: from 2.0, fixed in 2.5.22.
Fixed in 2.5.22 (released Nov 17, 2019, 18 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2011-3923Unrated
Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute…
Affected: from 2.0.0, fixed in 2.3.1.2.
Fixed in 2.3.1.2 (released Jan 20, 2012, 2842 days before disclosure).
The latest release, 7.4.0, is not affected.
Show all 60 advisoriesShow fewer advisories
- CVE-2018-11776High 8.1 · KEV
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (ei
Affected: from 2.0.4, fixed in 2.3.35; from 2.5, fixed in 2.5.17.
Fixed in 2.3.35 (released Jul 24, 2018, 29 days before disclosure) and 2.5.17 (released Aug 14, 2018, 8 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2016-4461Unrated
Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced…
Affected: from 2.0.0, fixed in 2.3.29.
Fixed in 2.3.29 (released Jun 14, 2016, 489 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2015-5169Unrated
Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
Affected: fixed in 2.3.20.
Fixed in 2.3.20 (released Nov 21, 2014, 1039 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2017-9804Unrated
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in…
Affected: from 2.3.7, fixed in 2.3.34; from 2.5.0, fixed in 2.5.13.
Fixed in 2.3.34 (released Sep 5, 2017, 15 days before disclosure) and 2.5.13 (released Aug 23, 2017, 28 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2017-12611Unrated
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string…
Affected: from 2.0.1, fixed in 2.3.34; from 2.5.0, fixed in 2.5.11.
Fixed in 2.3.34 (released Sep 5, 2017, 15 days before disclosure) and 2.5.12 (released Jul 6, 2017, 76 days before disclosure, the advisory names 2.5.11, which was never published).
The latest release, 7.4.0, is not affected.
- CVE-2016-8738Unrated
In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is…
Affected: from 2.5.0, fixed in 2.5.13.
Fixed in 2.5.13 (released Aug 23, 2017, 28 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2015-5209Unrated
Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container…
Affected: fixed in 2.3.24.1.
Fixed in 2.3.24.1 (released Sep 22, 2015, 707 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2017-9787Unrated
When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack.
Affected: from 2.3.7, fixed in 2.3.33; from 2.5.0, fixed in 2.5.12.
Fixed in 2.3.33 (released Jul 7, 2017, 6 days before disclosure) and 2.5.12 (released Jul 6, 2017, 7 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2017-7672Unrated
If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which…
Affected: from 2.5.0, fixed in 2.5.12.
Fixed in 2.5.12 (released Jul 6, 2017, 7 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2017-5638Critical 9.8 · KEV
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-mes
Affected: from 2.3.0, fixed in 2.3.32; from 2.5.0, fixed in 2.5.10.1.
Fixed in 2.3.32 (released Mar 6, 2017, 5 days before disclosure) and 2.5.10.1 (released Mar 6, 2017, 5 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2016-4436Unrated
Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action…
Affected: from 2.0.0, fixed in 2.3.29; from 2.5-BETA1, fixed in 2.5.1.
Fixed in 2.3.29 (released Jun 14, 2016, 111 days before disclosure) and 2.5.1 (released Jun 14, 2016, 111 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2016-4465Unrated
The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of…
Affected: from 2.3.20, fixed in 2.3.29; from 2.5.0, fixed in 2.5.13.
Fixed in 2.3.29 (released Jun 14, 2016, 20 days before disclosure) and 2.5.13 (released Aug 23, 2017, 415 days after disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2016-4438Unrated
The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.
Affected: from 2.3.19, fixed in 2.3.29.
Fixed in 2.3.29 (released Jun 14, 2016, 20 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2016-3093Unrated
Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote…
Affected: from 2.0.0, fixed in 2.3.24.3.
Fixed in 2.3.24.3 (released Apr 20, 2016, 48 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2016-3087Unrated
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote…
Affected: from 2.3.19, fixed in 2.3.20.3; from 2.3.21, fixed in 2.3.24.3; from 2.3.25, fixed in 2.3.28.1.
Fixed in 2.3.20.3 (released Apr 20, 2016, 48 days before disclosure), 2.3.24.3 (released Apr 20, 2016, 48 days before disclosure) and 2.3.28.1 (released Apr 19, 2016, 49 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2016-3082Unrated
XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute…
Affected: fixed in 2.3.20.3; from 2.3.24, fixed in 2.3.24.3; from 2.3.28, fixed in 2.3.28.1.
Fixed in 2.3.20.3 (released Apr 20, 2016, 6 days before disclosure), 2.3.24.3 (released Apr 20, 2016, 6 days before disclosure) and 2.3.28.1 (released Apr 19, 2016, 7 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2016-3081High 8.1 · KEV
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attacker
Affected: from 2.3.19, fixed in 2.3.20.3; from 2.3.21, fixed in 2.3.24.3; from 2.3.25, fixed in 2.3.28.1.
Fixed in 2.3.20.3 (released Apr 20, 2016, 6 days before disclosure), 2.3.24.3 (released Apr 20, 2016, 6 days before disclosure) and 2.3.28.1 (released Apr 19, 2016, 7 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2016-4003Unrated
Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when…
Affected: from 2.0.0, fixed in 2.3.28.
Fixed in 2.3.28 (released Mar 18, 2016, 25 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2016-2162Unrated
Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote…
Affected: from 2.0.0, fixed in 2.3.28.
Fixed in 2.3.28 (released Mar 18, 2016, 25 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2016-0785Unrated
Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced…
Affected: from 2.0.0, fixed in 2.3.20.3; from 2.3.24, fixed in 2.3.24.3.
Fixed in 2.3.20.3 (released Apr 20, 2016, 8 days after disclosure) and 2.3.24.3 (released Apr 20, 2016, 8 days after disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2015-1831Unrated
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an…
Affected: from 2.0.0, fixed in 2.3.20.1.
Fixed in 2.3.20.1 (released May 6, 2015, 71 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2014-7809Unrated
Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF…
Affected: fixed in 2.3.20.
Fixed in 2.3.20 (released Nov 21, 2014, 19 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2014-0116Unrated
CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the…
Affected: fixed in 2.3.20.
Fixed in 2.3.20 (released Nov 21, 2014, 197 days after disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2014-0113Unrated
CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the…
Affected: fixed in 2.3.20.
Fixed in 2.3.20 (released Nov 21, 2014, 206 days after disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2014-0112Unrated
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote…
Affected: fixed in 2.3.20.
Fixed in 2.3.20 (released Nov 21, 2014, 206 days after disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2014-0094Unrated
The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class…
Affected: from 2.0.0, fixed in 2.3.16.2.
Fixed in 2.3.16.2 (released Apr 24, 2014, 45 days after disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2013-6348Unrated
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or…
Affected: fixed in 2.3.16.
Fixed in 2.3.16 (released Nov 30, 2013, 28 days after disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2013-4316Unrated
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
Affected: from 2.0.0, fixed in 2.3.15.2.
Fixed in 2.3.15.2 (released Sep 18, 2013, 12 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2013-4310Unrated
Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix.
Affected: fixed in 2.3.15.3.
Fixed in 2.3.15.3 (released Oct 15, 2013, 15 days after disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2013-2251Critical 9.8 · KEV
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:,
Affected: fixed in 2.3.15.1.
Fixed in 2.3.15.1 (released Jul 14, 2013, 4 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2013-2248Unrated
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web…
Affected: fixed in 2.3.15.1.
Fixed in 2.3.15.1 (released Jul 14, 2013, 4 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2013-2135Unrated
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains…
Affected: from 2.0.0, fixed in 2.3.14.3.
Fixed in 2.3.14.3 (released Jun 3, 2013, 43 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2013-2134Unrated
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is…
Affected: from 2.0.0, fixed in 2.3.14.3.
Fixed in 2.3.14.3 (released Jun 3, 2013, 43 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2013-2115Unrated
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled…
Affected: from 2.0.0, fixed in 2.3.14.2.
Fixed in 2.3.14.2 (released May 24, 2013, 47 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2013-1966Unrated
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled…
Affected: from 2.0.0, fixed in 2.3.14.2.
Fixed in 2.3.14.2 (released May 24, 2013, 47 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2013-1965Unrated
Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL…
Affected: fixed in 2.3.14.3.
Fixed in 2.3.14.3 (released Jun 3, 2013, 37 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2012-4386Unrated
The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which…
Affected: from 2.0.0, fixed in 2.3.4.1.
Fixed in 2.3.4.1 (released Aug 3, 2012, 33 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2012-0838Unrated
Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote…
Affected: fixed in 2.2.3.1.
Fixed in 2.2.3.1 (released Sep 5, 2011, 179 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2012-0393Unrated
The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote…
Affected: fixed in 2.3.1.1.
Fixed in 2.3.1.1 (released Dec 25, 2011, 14 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2012-0392Unrated
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers…
Affected: fixed in 2.2.3.1.
Fixed in 2.2.3.1 (released Sep 5, 2011, 125 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2012-0391Critical 9.8 · KEV
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception ha
Affected: fixed in 2.2.3.1.
Fixed in 2.2.3.1 (released Sep 5, 2011, 125 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2011-1772Unrated
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony…
Affected: fixed in 2.2.3.
Fixed in 2.2.3 (released Apr 8, 2011, 35 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2010-1870Unrated
The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and…
Affected: fixed in 2.2.1.
Fixed in 2.2.1 (released Jul 17, 2010, 31 days before disclosure).
The latest release, 7.4.0, is not affected.
- CVE-2008-6682Unrated
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers…
Affected: from 2.0.0, fixed in 2.0.11.1; from 2.1.0, fixed in 2.1.1.
Fixed in 2.0.11.1 (released Mar 4, 2008, 401 days before disclosure) and 2.1.2 (released May 25, 2008, 319 days before disclosure, the advisory names 2.1.1, which was never published).
The latest release, 7.4.0, is not affected.
- CVE-2008-6505Unrated
Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read…
Affected: from 2.0.0, fixed in 2.0.12; from 2.1.0, fixed in 2.1.3.
Fixed in 2.0.12 (released Oct 20, 2008, 154 days before disclosure) and 2.1.6 (released Jan 13, 2009, 69 days before disclosure, the advisory names 2.1.3, which was never published).
The latest release, 7.4.0, is not affected.