# org.apache.struts:struts2-core (Maven) vulnerabilities 60 known vulnerabilities (6 critical, 6 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 7.4.0 (Sep 17, 2026): affected by CVE-2025-66675 - Newest unaffected release: Every release is affected by at least one advisory - Dependents: 25 - Releases: 112 since 2.0.5 (Feb 10, 2007) - Registry: https://central.sonatype.com/artifact/org.apache.struts/struts2-core - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2025-68493: 2.0.5 to 2.3.37 (2.5-BETA1 is outside it); 2.5 to 6.0.3 (6.1.1 is outside it) - CVE-2025-66675: 2.0.5 to 7.4.0 (through the newest release) - CVE-2025-64775: 2.0.5 to 6.7.4 (6.8.0 is outside it); 7.0.0 to 7.0.3 (7.1.1 is outside it) - CVE-2024-53677: 2.0.5 to 6.3.0.2 (6.4.0 is outside it) - CVE-2023-50164: 2.0.5 to 2.5.32 (2.5.33 is outside it); 6.0.0 to 6.3.0.1 (6.3.0.2 is outside it) - CVE-2023-41835: 2.0.5 to 2.5.31 (2.5.32 is outside it); 6.0.0 to 6.1.2.1 (6.1.2.2 is outside it); 6.2.0 to 6.3.0 (6.3.0.1 is outside it) - CVE-2023-34396: 2.0.5 to 2.5.30 (2.5.31 is outside it); 6.0.0 to 6.1.2 (6.1.2.1 is outside it) - CVE-2023-34149: 2.0.5 to 2.5.30 (2.5.31 is outside it); 6.0.0 to 6.1.2 (6.1.2.1 is outside it) - CVE-2021-31805: 2.0.5 to 2.5.29 (2.5.30 is outside it) - CVE-2020-17530: 2.0.5 to 2.5.25 (2.5.26 is outside it) - CVE-2019-0233: 2.0.5 to 2.5.20 (2.5.22 is outside it) - CVE-2019-0230: 2.0.5 to 2.5.20 (2.5.22 is outside it) - CVE-2015-2992: 2.0.5 to 2.3.16.3 (2.3.20 is outside it) - CVE-2012-1592: 2.0.5 to 2.5.20 (2.5.22 is outside it) - CVE-2011-3923: 2.0.5 to 2.3.1.1 (2.3.1.2 is outside it) - CVE-2018-11776: 2.0.5 to 2.3.34 (2.3.35 is outside it); 2.5 to 2.5.16 (2.5.17 is outside it) - CVE-2016-4461: 2.0.5 to 2.3.28.1 (2.3.29 is outside it) - CVE-2015-5169: 2.0.5 to 2.3.16.3 (2.3.20 is outside it) - CVE-2017-9804: 2.3.7 to 2.3.33 (2.3.34 is outside it); 2.5 to 2.5.12 (2.5.13 is outside it) - CVE-2017-12611: 2.0.5 to 2.3.33 (2.3.34 is outside it); 2.5 to 2.5.10.1 (2.5.12 is outside it) - CVE-2016-8738: 2.5 to 2.5.12 (2.5.13 is outside it) - CVE-2015-5209: 2.0.5 to 2.3.24 (2.3.24.1 is outside it) - CVE-2017-9787: 2.3.7 to 2.3.32 (2.3.33 is outside it); 2.5 to 2.5.10.1 (2.5.12 is outside it) - CVE-2017-7672: 2.5 to 2.5.10.1 (2.5.12 is outside it) - CVE-2017-5638: 2.3.1 to 2.3.31 (2.3.32 is outside it); 2.5 to 2.5.10 (2.5.10.1 is outside it) - CVE-2016-4436: 2.0.5 to 2.3.28.1 (2.3.29 is outside it); 2.5-BETA1 to 2.5 (2.5.1 is outside it) - CVE-2016-4465: 2.3.20 to 2.3.28.1 (2.3.29 is outside it); 2.5 to 2.5.12 (2.5.13 is outside it) - CVE-2016-4438: 2.3.20 to 2.3.28.1 (2.3.29 is outside it) - CVE-2016-3093: 2.0.5 to 2.3.24.1 (2.3.24.3 is outside it) - CVE-2016-3087: 2.3.20 to 2.3.20.1 (2.3.20.3 is outside it); 2.3.24 to 2.3.24.1 (2.3.24.3 is outside it); 2.3.28 (2.3.28.1 is outside it) - CVE-2016-3082: 2.0.5 to 2.3.20.1 (2.3.20.3 is outside it); 2.3.24 to 2.3.24.1 (2.3.24.3 is outside it); 2.3.28 (2.3.28.1 is outside it) - CVE-2016-3081: 2.3.20 to 2.3.20.1 (2.3.20.3 is outside it); 2.3.24 to 2.3.24.1 (2.3.24.3 is outside it); 2.3.28 (2.3.28.1 is outside it) - CVE-2016-4003: 2.0.5 to 2.3.24.3 (2.3.28 is outside it) - CVE-2016-2162: 2.0.5 to 2.3.24.3 (2.3.28 is outside it) - CVE-2016-0785: 2.0.5 to 2.3.20.1 (2.3.20.3 is outside it); 2.3.24 to 2.3.24.1 (2.3.24.3 is outside it) - CVE-2015-1831: 2.0.5 to 2.3.20 (2.3.20.1 is outside it) - CVE-2014-7809: 2.0.5 to 2.3.16.3 (2.3.20 is outside it) - CVE-2014-0116: 2.0.5 to 2.3.16.3 (2.3.20 is outside it) - CVE-2014-0113: 2.0.5 to 2.3.16.3 (2.3.20 is outside it) - CVE-2014-0112: 2.0.5 to 2.3.16.3 (2.3.20 is outside it) - CVE-2014-0094: 2.0.5 to 2.3.16.1 (2.3.16.2 is outside it) - CVE-2013-6348: 2.0.5 to 2.3.15.3 (2.3.16 is outside it) - CVE-2013-4316: 2.0.5 to 2.3.15.1 (2.3.15.2 is outside it) - CVE-2013-4310: 2.0.5 to 2.3.15.2 (2.3.15.3 is outside it) - CVE-2013-2251: 2.0.5 to 2.3.15 (2.3.15.1 is outside it) - CVE-2013-2248: 2.0.5 to 2.3.15 (2.3.15.1 is outside it) - CVE-2013-2135: 2.0.5 to 2.3.14.2 (2.3.14.3 is outside it) - CVE-2013-2134: 2.0.5 to 2.3.14.2 (2.3.14.3 is outside it) - CVE-2013-2115: 2.0.5 to 2.3.14.1 (2.3.14.2 is outside it) - CVE-2013-1966: 2.0.5 to 2.3.14.1 (2.3.14.2 is outside it) - CVE-2013-1965: 2.0.5 to 2.3.14.2 (2.3.14.3 is outside it) - CVE-2012-4386: 2.0.5 to 2.3.4 (2.3.4.1 is outside it) - CVE-2012-0838: 2.0.5 to 2.2.3 (2.2.3.1 is outside it) - CVE-2012-0393: 2.0.5 to 2.3.1 (2.3.1.1 is outside it) - CVE-2012-0392: 2.0.5 to 2.2.3 (2.2.3.1 is outside it) - CVE-2012-0391: 2.0.5 to 2.2.3 (2.2.3.1 is outside it) - CVE-2011-1772: 2.0.5 to 2.2.1.1 (2.2.3 is outside it) - CVE-2010-1870: 2.0.5 to 2.1.8.1 (2.2.1 is outside it) - CVE-2008-6682: 2.0.5 to 2.0.11 (2.0.11.1 is outside it) - CVE-2008-6505: 2.0.5 to 2.0.11.2 (2.0.12 is outside it); 2.1.2 (2.1.6 is outside it) ## Advisories (60) ### [CVE-2025-68493](https://cve.now/CVE-2025-68493): Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component - Severity: High 8.1 - Published: Jan 11, 2026 - Affected: from 2.0.0, through 2.3.37; from 2.5.0, through 2.5.33; from 6.0.0, fixed in 6.1.1. - Fixed in 6.1.1 (released Nov 15, 2022, 1153 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2025-66675](https://cve.now/CVE-2025-66675): Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed - Severity: High 8.2 - Published: Dec 10, 2025 - Affected: from 2.0.0; from 7.0.0; from 2.0.0, fixed in 6.8.0; from 7.0.0, fixed in 7.1.1. - No fix released. The latest release, 7.4.0, is still affected. ### [CVE-2025-64775](https://cve.now/CVE-2025-64775): Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - Severity: High 7.5 - Published: Dec 1, 2025 - Affected: from 2.0.0, through 6.7.0; from 7.0.0, through 7.0.3; from 6.0.0, fixed in 6.8.0; from 7.0.0, fixed in 7.1.1; from 2.0.0, through 2.3.37; from 2.5.0, through 2.5.33. - Fixed in 6.8.0 (released Sep 15, 2025, 77 days before disclosure) and 7.1.1 (released Oct 1, 2025, 61 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2024-53677](https://cve.now/CVE-2024-53677): Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks - Severity: Critical 9.5 - Published: Dec 11, 2024 - Affected: from 2.0.0, fixed in 6.4.0; fixed in 6.4.0. - Fixed in 6.4.0 (released Apr 7, 2024, 248 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2023-50164](https://cve.now/CVE-2023-50164): Apache Struts: File upload component had a directory traversal vulnerability - Severity: Critical - Published: Dec 7, 2023 - Affected: from 2.0.0, fixed in 2.5.33; from 6.0.0, fixed in 6.3.0.2. - Fixed in 2.5.33 (released Dec 5, 2023, 2 days before disclosure) and 6.3.0.2 (released Dec 5, 2023, 2 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2023-41835](https://cve.now/CVE-2023-41835): Apache Struts: excessive disk usage - Severity: High 7.5 - Published: Dec 5, 2023 - Affected: from 6.2.0, fixed in 6.3.0.1; from 6.0.0, fixed in 6.1.2.2; fixed in 2.5.32. - Fixed in 2.5.32 (released Sep 11, 2023, 85 days before disclosure), 6.1.2.2 (released Sep 11, 2023, 85 days before disclosure) and 6.3.0.1 (released Sep 11, 2023, 85 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2023-34396](https://cve.now/CVE-2023-34396): Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms - Severity: Medium 4.3 - Published: Jun 14, 2023 - Affected: fixed in 2.5.31; from 6.0.0, fixed in 6.1.2.1. - Fixed in 2.5.31 (released Jun 13, 2023, 1 day before disclosure) and 6.1.2.1 (released Jun 13, 2023, 1 day before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2023-34149](https://cve.now/CVE-2023-34149): Apache Struts: DoS via OOM owing to not properly checking of list bounds - Severity: Medium 4.3 - Published: Jun 14, 2023 - Affected: fixed in 2.5.31; from 6.0.0, fixed in 6.1.2.1. - Fixed in 2.5.31 (released Jun 13, 2023, 1 day before disclosure) and 6.1.2.1 (released Jun 13, 2023, 1 day before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2021-31805](https://cve.now/CVE-2021-31805): Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE. - Severity: Unrated - Published: Apr 12, 2022 - Affected: from 2.0.0, fixed in 2.5.30. - Fixed in 2.5.30 (released Mar 15, 2022, 28 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2020-17530](https://cve.now/CVE-2020-17530): Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. - Severity: Critical 9.8 · KEV - Published: Dec 11, 2020 - Affected: from 2.0.0, fixed in 2.5.26. - Fixed in 2.5.26 (released Nov 25, 2020, 16 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2019-0233](https://cve.now/CVE-2019-0233): An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload. - Severity: Unrated - Published: Sep 14, 2020 - Affected: from 2.0.0, fixed in 2.5.22. - Fixed in 2.5.22 (released Nov 17, 2019, 302 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2019-0230](https://cve.now/CVE-2019-0230): Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code… - Severity: Unrated - Published: Sep 14, 2020 - Affected: from 2.0.0, fixed in 2.5.22. - Fixed in 2.5.22 (released Nov 17, 2019, 302 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2015-2992](https://cve.now/CVE-2015-2992): Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability. - Severity: Unrated - Published: Feb 27, 2020 - Affected: fixed in 2.3.20. - Fixed in 2.3.20 (released Nov 21, 2014, 1924 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2012-1592](https://cve.now/CVE-2012-1592): A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and… - Severity: Unrated - Published: Dec 5, 2019 - Affected: from 2.0, fixed in 2.5.22. - Fixed in 2.5.22 (released Nov 17, 2019, 18 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2011-3923](https://cve.now/CVE-2011-3923): Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute… - Severity: Unrated - Published: Nov 1, 2019 - Affected: from 2.0.0, fixed in 2.3.1.2. - Fixed in 2.3.1.2 (released Jan 20, 2012, 2842 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2018-11776](https://cve.now/CVE-2018-11776): Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (ei - Severity: High 8.1 · KEV - Published: Aug 22, 2018 - Affected: from 2.0.4, fixed in 2.3.35; from 2.5, fixed in 2.5.17. - Fixed in 2.3.35 (released Jul 24, 2018, 29 days before disclosure) and 2.5.17 (released Aug 14, 2018, 8 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2016-4461](https://cve.now/CVE-2016-4461): Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced… - Severity: Unrated - Published: Oct 16, 2017 - Affected: from 2.0.0, fixed in 2.3.29. - Fixed in 2.3.29 (released Jun 14, 2016, 489 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2015-5169](https://cve.now/CVE-2015-5169): Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20. - Severity: Unrated - Published: Sep 25, 2017 - Affected: fixed in 2.3.20. - Fixed in 2.3.20 (released Nov 21, 2014, 1039 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2017-9804](https://cve.now/CVE-2017-9804): In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in… - Severity: Unrated - Published: Sep 20, 2017 - Affected: from 2.3.7, fixed in 2.3.34; from 2.5.0, fixed in 2.5.13. - Fixed in 2.3.34 (released Sep 5, 2017, 15 days before disclosure) and 2.5.13 (released Aug 23, 2017, 28 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2017-12611](https://cve.now/CVE-2017-12611): In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string… - Severity: Unrated - Published: Sep 20, 2017 - Affected: from 2.0.1, fixed in 2.3.34; from 2.5.0, fixed in 2.5.11. - Fixed in 2.3.34 (released Sep 5, 2017, 15 days before disclosure) and 2.5.12 (released Jul 6, 2017, 76 days before disclosure, the advisory names 2.5.11, which was never published). - The latest release, 7.4.0, is not affected. ### [CVE-2016-8738](https://cve.now/CVE-2016-8738): In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is… - Severity: Unrated - Published: Sep 20, 2017 - Affected: from 2.5.0, fixed in 2.5.13. - Fixed in 2.5.13 (released Aug 23, 2017, 28 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2015-5209](https://cve.now/CVE-2015-5209): Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container… - Severity: Unrated - Published: Aug 29, 2017 - Affected: fixed in 2.3.24.1. - Fixed in 2.3.24.1 (released Sep 22, 2015, 707 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2017-9787](https://cve.now/CVE-2017-9787): When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. - Severity: Unrated - Published: Jul 13, 2017 - Affected: from 2.3.7, fixed in 2.3.33; from 2.5.0, fixed in 2.5.12. - Fixed in 2.3.33 (released Jul 7, 2017, 6 days before disclosure) and 2.5.12 (released Jul 6, 2017, 7 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2017-7672](https://cve.now/CVE-2017-7672): If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which… - Severity: Unrated - Published: Jul 13, 2017 - Affected: from 2.5.0, fixed in 2.5.12. - Fixed in 2.5.12 (released Jul 6, 2017, 7 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2017-5638](https://cve.now/CVE-2017-5638): The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-mes - Severity: Critical 9.8 · KEV - Published: Mar 11, 2017 - Affected: from 2.3.0, fixed in 2.3.32; from 2.5.0, fixed in 2.5.10.1. - Fixed in 2.3.32 (released Mar 6, 2017, 5 days before disclosure) and 2.5.10.1 (released Mar 6, 2017, 5 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2016-4436](https://cve.now/CVE-2016-4436): Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action… - Severity: Unrated - Published: Oct 3, 2016 - Affected: from 2.0.0, fixed in 2.3.29; from 2.5-BETA1, fixed in 2.5.1. - Fixed in 2.3.29 (released Jun 14, 2016, 111 days before disclosure) and 2.5.1 (released Jun 14, 2016, 111 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2016-4465](https://cve.now/CVE-2016-4465): The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of… - Severity: Unrated - Published: Jul 4, 2016 - Affected: from 2.3.20, fixed in 2.3.29; from 2.5.0, fixed in 2.5.13. - Fixed in 2.3.29 (released Jun 14, 2016, 20 days before disclosure) and 2.5.13 (released Aug 23, 2017, 415 days after disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2016-4438](https://cve.now/CVE-2016-4438): The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression. - Severity: Unrated - Published: Jul 4, 2016 - Affected: from 2.3.19, fixed in 2.3.29. - Fixed in 2.3.29 (released Jun 14, 2016, 20 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2016-3093](https://cve.now/CVE-2016-3093): Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote… - Severity: Unrated - Published: Jun 7, 2016 - Affected: from 2.0.0, fixed in 2.3.24.3. - Fixed in 2.3.24.3 (released Apr 20, 2016, 48 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2016-3087](https://cve.now/CVE-2016-3087): Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote… - Severity: Unrated - Published: Jun 7, 2016 - Affected: from 2.3.19, fixed in 2.3.20.3; from 2.3.21, fixed in 2.3.24.3; from 2.3.25, fixed in 2.3.28.1. - Fixed in 2.3.20.3 (released Apr 20, 2016, 48 days before disclosure), 2.3.24.3 (released Apr 20, 2016, 48 days before disclosure) and 2.3.28.1 (released Apr 19, 2016, 49 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2016-3082](https://cve.now/CVE-2016-3082): XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute… - Severity: Unrated - Published: Apr 26, 2016 - Affected: fixed in 2.3.20.3; from 2.3.24, fixed in 2.3.24.3; from 2.3.28, fixed in 2.3.28.1. - Fixed in 2.3.20.3 (released Apr 20, 2016, 6 days before disclosure), 2.3.24.3 (released Apr 20, 2016, 6 days before disclosure) and 2.3.28.1 (released Apr 19, 2016, 7 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2016-3081](https://cve.now/CVE-2016-3081): Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attacker - Severity: High 8.1 · KEV - Published: Apr 26, 2016 - Affected: from 2.3.19, fixed in 2.3.20.3; from 2.3.21, fixed in 2.3.24.3; from 2.3.25, fixed in 2.3.28.1. - Fixed in 2.3.20.3 (released Apr 20, 2016, 6 days before disclosure), 2.3.24.3 (released Apr 20, 2016, 6 days before disclosure) and 2.3.28.1 (released Apr 19, 2016, 7 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2016-4003](https://cve.now/CVE-2016-4003): Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when… - Severity: Unrated - Published: Apr 12, 2016 - Affected: from 2.0.0, fixed in 2.3.28. - Fixed in 2.3.28 (released Mar 18, 2016, 25 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2016-2162](https://cve.now/CVE-2016-2162): Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote… - Severity: Unrated - Published: Apr 12, 2016 - Affected: from 2.0.0, fixed in 2.3.28. - Fixed in 2.3.28 (released Mar 18, 2016, 25 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2016-0785](https://cve.now/CVE-2016-0785): Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced… - Severity: Unrated - Published: Apr 12, 2016 - Affected: from 2.0.0, fixed in 2.3.20.3; from 2.3.24, fixed in 2.3.24.3. - Fixed in 2.3.20.3 (released Apr 20, 2016, 8 days after disclosure) and 2.3.24.3 (released Apr 20, 2016, 8 days after disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2015-1831](https://cve.now/CVE-2015-1831): The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an… - Severity: Unrated - Published: Jul 16, 2015 - Affected: from 2.0.0, fixed in 2.3.20.1. - Fixed in 2.3.20.1 (released May 6, 2015, 71 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2014-7809](https://cve.now/CVE-2014-7809): Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable \ values, which allows remote attackers to bypass the CSRF… - Severity: Unrated - Published: Dec 10, 2014 - Affected: fixed in 2.3.20. - Fixed in 2.3.20 (released Nov 21, 2014, 19 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2014-0116](https://cve.now/CVE-2014-0116): CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the… - Severity: Unrated - Published: May 8, 2014 - Affected: fixed in 2.3.20. - Fixed in 2.3.20 (released Nov 21, 2014, 197 days after disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2014-0113](https://cve.now/CVE-2014-0113): CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the… - Severity: Unrated - Published: Apr 29, 2014 - Affected: fixed in 2.3.20. - Fixed in 2.3.20 (released Nov 21, 2014, 206 days after disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2014-0112](https://cve.now/CVE-2014-0112): ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote… - Severity: Unrated - Published: Apr 29, 2014 - Affected: fixed in 2.3.20. - Fixed in 2.3.20 (released Nov 21, 2014, 206 days after disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2014-0094](https://cve.now/CVE-2014-0094): The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class… - Severity: Unrated - Published: Mar 10, 2014 - Affected: from 2.0.0, fixed in 2.3.16.2. - Fixed in 2.3.16.2 (released Apr 24, 2014, 45 days after disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2013-6348](https://cve.now/CVE-2013-6348): Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or… - Severity: Unrated - Published: Nov 2, 2013 - Affected: fixed in 2.3.16. - Fixed in 2.3.16 (released Nov 30, 2013, 28 days after disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2013-4316](https://cve.now/CVE-2013-4316): Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors. - Severity: Unrated - Published: Sep 30, 2013 - Affected: from 2.0.0, fixed in 2.3.15.2. - Fixed in 2.3.15.2 (released Sep 18, 2013, 12 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2013-4310](https://cve.now/CVE-2013-4310): Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix. - Severity: Unrated - Published: Sep 30, 2013 - Affected: fixed in 2.3.15.3. - Fixed in 2.3.15.3 (released Oct 15, 2013, 15 days after disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2013-2251](https://cve.now/CVE-2013-2251): Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, - Severity: Critical 9.8 · KEV - Published: Jul 18, 2013 - Affected: fixed in 2.3.15.1. - Fixed in 2.3.15.1 (released Jul 14, 2013, 4 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2013-2248](https://cve.now/CVE-2013-2248): Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web… - Severity: Unrated - Published: Jul 18, 2013 - Affected: fixed in 2.3.15.1. - Fixed in 2.3.15.1 (released Jul 14, 2013, 4 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2013-2135](https://cve.now/CVE-2013-2135): Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains… - Severity: Unrated - Published: Jul 16, 2013 - Affected: from 2.0.0, fixed in 2.3.14.3. - Fixed in 2.3.14.3 (released Jun 3, 2013, 43 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2013-2134](https://cve.now/CVE-2013-2134): Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is… - Severity: Unrated - Published: Jul 16, 2013 - Affected: from 2.0.0, fixed in 2.3.14.3. - Fixed in 2.3.14.3 (released Jun 3, 2013, 43 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2013-2115](https://cve.now/CVE-2013-2115): Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled… - Severity: Unrated - Published: Jul 10, 2013 - Affected: from 2.0.0, fixed in 2.3.14.2. - Fixed in 2.3.14.2 (released May 24, 2013, 47 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2013-1966](https://cve.now/CVE-2013-1966): Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled… - Severity: Unrated - Published: Jul 10, 2013 - Affected: from 2.0.0, fixed in 2.3.14.2. - Fixed in 2.3.14.2 (released May 24, 2013, 47 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2013-1965](https://cve.now/CVE-2013-1965): Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL… - Severity: Unrated - Published: Jul 10, 2013 - Affected: fixed in 2.3.14.3. - Fixed in 2.3.14.3 (released Jun 3, 2013, 37 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2012-4386](https://cve.now/CVE-2012-4386): The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which… - Severity: Unrated - Published: Sep 5, 2012 - Affected: from 2.0.0, fixed in 2.3.4.1. - Fixed in 2.3.4.1 (released Aug 3, 2012, 33 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2012-0838](https://cve.now/CVE-2012-0838): Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote… - Severity: Unrated - Published: Mar 2, 2012 - Affected: fixed in 2.2.3.1. - Fixed in 2.2.3.1 (released Sep 5, 2011, 179 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2012-0393](https://cve.now/CVE-2012-0393): The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote… - Severity: Unrated - Published: Jan 8, 2012 - Affected: fixed in 2.3.1.1. - Fixed in 2.3.1.1 (released Dec 25, 2011, 14 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2012-0392](https://cve.now/CVE-2012-0392): The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers… - Severity: Unrated - Published: Jan 8, 2012 - Affected: fixed in 2.2.3.1. - Fixed in 2.2.3.1 (released Sep 5, 2011, 125 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2012-0391](https://cve.now/CVE-2012-0391): The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception ha - Severity: Critical 9.8 · KEV - Published: Jan 8, 2012 - Affected: fixed in 2.2.3.1. - Fixed in 2.2.3.1 (released Sep 5, 2011, 125 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2011-1772](https://cve.now/CVE-2011-1772): Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony… - Severity: Unrated - Published: May 13, 2011 - Affected: fixed in 2.2.3. - Fixed in 2.2.3 (released Apr 8, 2011, 35 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2010-1870](https://cve.now/CVE-2010-1870): The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and… - Severity: Unrated - Published: Aug 17, 2010 - Affected: fixed in 2.2.1. - Fixed in 2.2.1 (released Jul 17, 2010, 31 days before disclosure). - The latest release, 7.4.0, is not affected. ### [CVE-2008-6682](https://cve.now/CVE-2008-6682): Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers… - Severity: Unrated - Published: Apr 9, 2009 - Affected: from 2.0.0, fixed in 2.0.11.1; from 2.1.0, fixed in 2.1.1. - Fixed in 2.0.11.1 (released Mar 4, 2008, 401 days before disclosure) and 2.1.2 (released May 25, 2008, 319 days before disclosure, the advisory names 2.1.1, which was never published). - The latest release, 7.4.0, is not affected. ### [CVE-2008-6505](https://cve.now/CVE-2008-6505): Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read… - Severity: Unrated - Published: Mar 23, 2009 - Affected: from 2.0.0, fixed in 2.0.12; from 2.1.0, fixed in 2.1.3. - Fixed in 2.0.12 (released Oct 20, 2008, 154 days before disclosure) and 2.1.6 (released Jan 13, 2009, 69 days before disclosure, the advisory names 2.1.3, which was never published). - The latest release, 7.4.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.struts:struts2-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.