Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.apache.struts/struts2-core@2.3.14.2
Typemaven
Namespaceorg.apache.struts
Namestruts2-core
Version2.3.14.2
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version6.8.0
Latest_non_vulnerable_version7.1.1
Affected_by_vulnerabilities
0
url VCID-1exe-1vfk-f7bn
vulnerability_id VCID-1exe-1vfk-f7bn
summary 
Allows open redirects
Multiple open redirect vulnerabilities in this package allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the `redirect:` or `redirectAction:` prefix.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-2248
reference_id
reference_type
scores
0
value 0.91954
scoring_system epss
scoring_elements 0.99713
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-2248
1
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
2
reference_url https://github.com/apache/struts/commit/3cfe34fefedcf0fdcfcb061c0aea34a715b7de6
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/3cfe34fefedcf0fdcfcb061c0aea34a715b7de6
3
reference_url https://github.com/apache/struts/commit/630e1ba065a8215c4e9ac03bfb09be9d655c2b6e
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/630e1ba065a8215c4e9ac03bfb09be9d655c2b6e
4
reference_url https://issues.apache.org/jira/browse/WW-4140
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://issues.apache.org/jira/browse/WW-4140
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-2248
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-2248
6
reference_url http://struts.apache.org/docs/s2-017.html
reference_id
reference_type
scores
url http://struts.apache.org/docs/s2-017.html
7
reference_url http://struts.apache.org/release/2.3.x/docs/s2-017.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://struts.apache.org/release/2.3.x/docs/s2-017.html
8
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/38666.txt
reference_id CVE-2013-2248;OSVDB-95406
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/38666.txt
9
reference_url https://www.securityfocus.com/bid/61196/info
reference_id CVE-2013-2248;OSVDB-95406
reference_type exploit
scores
url https://www.securityfocus.com/bid/61196/info
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.15.1
purl pkg:maven/org.apache.struts/struts2-core@2.3.15.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1uv2-rvmy-53hk
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-4bzw-ges2-d7ek
3
vulnerability VCID-4ywn-n1my-83ev
4
vulnerability VCID-7hxh-btrk-skhg
5
vulnerability VCID-7uv9-4vy7-ryd1
6
vulnerability VCID-84ge-vq7u-j3ar
7
vulnerability VCID-8cmt-z8g9-duf2
8
vulnerability VCID-8jup-umjw-9ba4
9
vulnerability VCID-9mn7-d2mm-uqay
10
vulnerability VCID-cv6j-98vx-n3ed
11
vulnerability VCID-dbzr-zyeu-73g8
12
vulnerability VCID-dj42-wym9-nbhv
13
vulnerability VCID-dvxu-9sh6-qbef
14
vulnerability VCID-fvde-37ch-z7cg
15
vulnerability VCID-fwkj-x53j-yqd8
16
vulnerability VCID-ghqg-ae1b-w7br
17
vulnerability VCID-gvwn-8r4r-47gm
18
vulnerability VCID-hrky-nmnv-g3eu
19
vulnerability VCID-jzbz-jpe1-cycg
20
vulnerability VCID-kmqa-hsqy-muf1
21
vulnerability VCID-m39c-3bv2-6ugy
22
vulnerability VCID-mmth-7rgf-aqfa
23
vulnerability VCID-mvdz-exud-3ybz
24
vulnerability VCID-nm42-xrpq-7ued
25
vulnerability VCID-npge-yn8z-6fac
26
vulnerability VCID-nztp-y8p8-cqc6
27
vulnerability VCID-pdny-erzd-jqhc
28
vulnerability VCID-q2ad-khtm-nqdr
29
vulnerability VCID-renj-v5ce-2khx
30
vulnerability VCID-t1s3-f181-tqca
31
vulnerability VCID-vztu-pap6-37ev
32
vulnerability VCID-wtca-5ffw-w7bc
33
vulnerability VCID-wzez-6cmp-n7gn
34
vulnerability VCID-xgnf-d44x-kfc9
35
vulnerability VCID-z1jy-4da2-tyhk
36
vulnerability VCID-z6wr-3psx-dbfm
37
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.15.1
aliases CVE-2013-2248, GHSA-rpj9-r897-wc6q
risk_score 10.0
exploitability 2.0
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1exe-1vfk-f7bn
1
url VCID-1kjb-use6-23eu
vulnerability_id VCID-1kjb-use6-23eu
summary 
Code Injection
Apache Struts allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both `${}` and `%{}` sequences, which causes the OGNL code to be evaluated twice.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-2135
reference_id
reference_type
scores
0
value 0.83013
scoring_system epss
scoring_elements 0.99273
published_at 2026-06-05T12:55:00Z
1
value 0.83013
scoring_system epss
scoring_elements 0.99272
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-2135
1
reference_url https://cwiki.apache.org/confluence/display/WW/S2-015
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://cwiki.apache.org/confluence/display/WW/S2-015
2
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
3
reference_url https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e
4
reference_url https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e0
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e0
5
reference_url https://github.com/apache/struts/commit/041206d2a693d02c0cb2e72765275e55ba14049f
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/041206d2a693d02c0cb2e72765275e55ba14049f
6
reference_url https://github.com/apache/struts/commit/113c47082c09818bcef65acc436a2d0c7c47aa6c
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/113c47082c09818bcef65acc436a2d0c7c47aa6c
7
reference_url https://github.com/apache/struts/commit/54e5c912ebd9a1599bfcf7a719da17c28127bbe
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/54e5c912ebd9a1599bfcf7a719da17c28127bbe
8
reference_url https://github.com/apache/struts/commit/54e5c912ebd9a1599bfcf7a719da17c28127bbe3
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/54e5c912ebd9a1599bfcf7a719da17c28127bbe3
9
reference_url https://github.com/apache/struts/commit/711cf0201cdd319a38cf29238913312355db29ba
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/711cf0201cdd319a38cf29238913312355db29ba
10
reference_url https://github.com/apache/struts/commit/8b4fc81daeea3834bcbf73de5f48d0021917aa3
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/8b4fc81daeea3834bcbf73de5f48d0021917aa3
11
reference_url https://github.com/apache/struts/commit/8b4fc81daeea3834bcbf73de5f48d0021917aa37
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/8b4fc81daeea3834bcbf73de5f48d0021917aa37
12
reference_url https://github.com/apache/struts/commit/cfb6e9afbae320a4dd5bdd655154ab9fe5a92c1
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/cfb6e9afbae320a4dd5bdd655154ab9fe5a92c1
13
reference_url https://github.com/apache/struts/commit/cfb6e9afbae320a4dd5bdd655154ab9fe5a92c16
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/cfb6e9afbae320a4dd5bdd655154ab9fe5a92c16
14
reference_url https://issues.apache.org/jira/browse/WW-4090
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://issues.apache.org/jira/browse/WW-4090
15
reference_url https://issues.apache.org/jira/browse/WW-4094
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://issues.apache.org/jira/browse/WW-4094
16
reference_url https://issues.apache.org/jira/browse/WW-4095
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://issues.apache.org/jira/browse/WW-4095
17
reference_url http://struts.apache.org/development/2.x/docs/s2-015.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://struts.apache.org/development/2.x/docs/s2-015.html
18
reference_url http://struts.apache.org/docs/s2-015.html
reference_id
reference_type
scores
url http://struts.apache.org/docs/s2-015.html
19
reference_url https://web.archive.org/web/20140410223942/http://www.securityfocus.com/bid/64758
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20140410223942/http://www.securityfocus.com/bid/64758
20
reference_url http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
21
reference_url http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
22
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-2135
reference_id CVE-2013-2135
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-2135
23
reference_url https://github.com/advisories/GHSA-pw8r-x2qm-3h5m
reference_id GHSA-pw8r-x2qm-3h5m
reference_type
scores
url https://github.com/advisories/GHSA-pw8r-x2qm-3h5m
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.14.3
purl pkg:maven/org.apache.struts/struts2-core@2.3.14.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1exe-1vfk-f7bn
1
vulnerability VCID-1uv2-rvmy-53hk
2
vulnerability VCID-4bm7-hbe1-mfca
3
vulnerability VCID-4bzw-ges2-d7ek
4
vulnerability VCID-4ywn-n1my-83ev
5
vulnerability VCID-7hxh-btrk-skhg
6
vulnerability VCID-7uv9-4vy7-ryd1
7
vulnerability VCID-84ge-vq7u-j3ar
8
vulnerability VCID-8cmt-z8g9-duf2
9
vulnerability VCID-8jup-umjw-9ba4
10
vulnerability VCID-9mn7-d2mm-uqay
11
vulnerability VCID-cv6j-98vx-n3ed
12
vulnerability VCID-dbzr-zyeu-73g8
13
vulnerability VCID-dj42-wym9-nbhv
14
vulnerability VCID-dvxu-9sh6-qbef
15
vulnerability VCID-fvde-37ch-z7cg
16
vulnerability VCID-fwkj-x53j-yqd8
17
vulnerability VCID-ghqg-ae1b-w7br
18
vulnerability VCID-gvwn-8r4r-47gm
19
vulnerability VCID-hrky-nmnv-g3eu
20
vulnerability VCID-jzbz-jpe1-cycg
21
vulnerability VCID-kmqa-hsqy-muf1
22
vulnerability VCID-m39c-3bv2-6ugy
23
vulnerability VCID-mmth-7rgf-aqfa
24
vulnerability VCID-mvdz-exud-3ybz
25
vulnerability VCID-nm42-xrpq-7ued
26
vulnerability VCID-npge-yn8z-6fac
27
vulnerability VCID-nztp-y8p8-cqc6
28
vulnerability VCID-pdny-erzd-jqhc
29
vulnerability VCID-q2ad-khtm-nqdr
30
vulnerability VCID-renj-v5ce-2khx
31
vulnerability VCID-t1s3-f181-tqca
32
vulnerability VCID-vztu-pap6-37ev
33
vulnerability VCID-wtca-5ffw-w7bc
34
vulnerability VCID-wzez-6cmp-n7gn
35
vulnerability VCID-xgnf-d44x-kfc9
36
vulnerability VCID-xpa5-fsb6-ukay
37
vulnerability VCID-z1jy-4da2-tyhk
38
vulnerability VCID-z6wr-3psx-dbfm
39
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.14.3
aliases CVE-2013-2135, GHSA-pw8r-x2qm-3h5m
risk_score 10.0
exploitability 2.0
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1kjb-use6-23eu
2
url VCID-1uv2-rvmy-53hk
vulnerability_id VCID-1uv2-rvmy-53hk
summary 
Incomplete fix for ClassLoader manipulation via ParametersInterceptor
This package does not properly restrict access to the getClass method, which allows remote attackers to `manipulate` the `ClassLoader` and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
references
0
reference_url http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045
1
reference_url http://jvn.jp/en/jp/JVN19294237/index.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://jvn.jp/en/jp/JVN19294237/index.html
2
reference_url http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
3
reference_url https://access.redhat.com/errata/RHSA-2019:0910
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2019:0910
4
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0112.json
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0112.json
5
reference_url https://api.first.org/data/v1/epss?cve=CVE-2014-0112
reference_id
reference_type
scores
0
value 0.91467
scoring_system epss
scoring_elements 0.99682
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2014-0112
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1091939
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=1091939
7
reference_url https://cwiki.apache.org/confluence/display/WW/S2-021
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://cwiki.apache.org/confluence/display/WW/S2-021
8
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
9
reference_url https://github.com/apache/struts/commit/74e26830d2849a84729b33497f729e0f033dc147
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/74e26830d2849a84729b33497f729e0f033dc147
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2014-0112
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2014-0112
11
reference_url http://struts.apache.org/docs/s2-021.html
reference_id
reference_type
scores
url http://struts.apache.org/docs/s2-021.html
12
reference_url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0112
reference_id
reference_type
scores
url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0112
13
reference_url http://www-01.ibm.com/support/docview.wss?uid=swg21676706
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www-01.ibm.com/support/docview.wss?uid=swg21676706
14
reference_url http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
15
reference_url http://www.vmware.com/security/advisories/VMSA-2014-0007.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.vmware.com/security/advisories/VMSA-2014-0007.html
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.16.2
purl pkg:maven/org.apache.struts/struts2-core@2.3.16.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-4bzw-ges2-d7ek
2
vulnerability VCID-4ywn-n1my-83ev
3
vulnerability VCID-7hxh-btrk-skhg
4
vulnerability VCID-7uv9-4vy7-ryd1
5
vulnerability VCID-8cmt-z8g9-duf2
6
vulnerability VCID-9mn7-d2mm-uqay
7
vulnerability VCID-cv6j-98vx-n3ed
8
vulnerability VCID-dbzr-zyeu-73g8
9
vulnerability VCID-dj42-wym9-nbhv
10
vulnerability VCID-dvxu-9sh6-qbef
11
vulnerability VCID-fwkj-x53j-yqd8
12
vulnerability VCID-ghqg-ae1b-w7br
13
vulnerability VCID-gvwn-8r4r-47gm
14
vulnerability VCID-hrky-nmnv-g3eu
15
vulnerability VCID-jzbz-jpe1-cycg
16
vulnerability VCID-m39c-3bv2-6ugy
17
vulnerability VCID-mmth-7rgf-aqfa
18
vulnerability VCID-mvdz-exud-3ybz
19
vulnerability VCID-nm42-xrpq-7ued
20
vulnerability VCID-npge-yn8z-6fac
21
vulnerability VCID-nztp-y8p8-cqc6
22
vulnerability VCID-pdny-erzd-jqhc
23
vulnerability VCID-q2ad-khtm-nqdr
24
vulnerability VCID-renj-v5ce-2khx
25
vulnerability VCID-t1s3-f181-tqca
26
vulnerability VCID-vztu-pap6-37ev
27
vulnerability VCID-wtca-5ffw-w7bc
28
vulnerability VCID-wzez-6cmp-n7gn
29
vulnerability VCID-xgnf-d44x-kfc9
30
vulnerability VCID-z1jy-4da2-tyhk
31
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.16.2
1
url pkg:maven/org.apache.struts/struts2-core@2.3.20
purl pkg:maven/org.apache.struts/struts2-core@2.3.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1cxn-qv1w-2kh7
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-4bzw-ges2-d7ek
3
vulnerability VCID-4t8h-s9mh-p7c4
4
vulnerability VCID-6dfe-8yy4-kkfj
5
vulnerability VCID-7hxh-btrk-skhg
6
vulnerability VCID-7uv9-4vy7-ryd1
7
vulnerability VCID-8cmt-z8g9-duf2
8
vulnerability VCID-9mn7-d2mm-uqay
9
vulnerability VCID-cv6j-98vx-n3ed
10
vulnerability VCID-dbzr-zyeu-73g8
11
vulnerability VCID-dj42-wym9-nbhv
12
vulnerability VCID-dvxu-9sh6-qbef
13
vulnerability VCID-fwkj-x53j-yqd8
14
vulnerability VCID-gvwn-8r4r-47gm
15
vulnerability VCID-hrky-nmnv-g3eu
16
vulnerability VCID-jzbz-jpe1-cycg
17
vulnerability VCID-mmth-7rgf-aqfa
18
vulnerability VCID-mvdz-exud-3ybz
19
vulnerability VCID-nm42-xrpq-7ued
20
vulnerability VCID-npge-yn8z-6fac
21
vulnerability VCID-nztp-y8p8-cqc6
22
vulnerability VCID-pdny-erzd-jqhc
23
vulnerability VCID-q2ad-khtm-nqdr
24
vulnerability VCID-qdsq-8td3-5qa1
25
vulnerability VCID-renj-v5ce-2khx
26
vulnerability VCID-vztu-pap6-37ev
27
vulnerability VCID-wzez-6cmp-n7gn
28
vulnerability VCID-xgnf-d44x-kfc9
29
vulnerability VCID-z1jy-4da2-tyhk
30
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.20
aliases CVE-2014-0112, GHSA-prjv-jj26-wf8h
risk_score 10.0
exploitability 2.0
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1uv2-rvmy-53hk
3
url VCID-447s-4ag7-gyes
vulnerability_id VCID-447s-4ag7-gyes
summary 
Remote command execution
This package allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-1965.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-1965.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-1965
reference_id
reference_type
scores
0
value 0.91789
scoring_system epss
scoring_elements 0.99702
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-1965
2
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=967655
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=967655
3
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
4
reference_url https://github.com/apache/struts/commit/7e6f641ebb142663cbd1653dc49bed725edf7f56
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/7e6f641ebb142663cbd1653dc49bed725edf7f56
5
reference_url http://struts.apache.org/development/2.x/docs/s2-012.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://struts.apache.org/development/2.x/docs/s2-012.html
6
reference_url http://struts.apache.org/docs/s2-012.html
reference_id
reference_type
scores
url http://struts.apache.org/docs/s2-012.html
7
reference_url https://web.archive.org/web/20140227231557/http://www.securityfocus.com/bid/60082
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20140227231557/http://www.securityfocus.com/bid/60082
8
reference_url http://www.securityfocus.com/bid/60082
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/60082
9
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-1965
reference_id CVE-2013-1965
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-1965
10
reference_url https://github.com/advisories/GHSA-whmq-v94q-34p9
reference_id GHSA-whmq-v94q-34p9
reference_type
scores
url https://github.com/advisories/GHSA-whmq-v94q-34p9
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.14.3
purl pkg:maven/org.apache.struts/struts2-core@2.3.14.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1exe-1vfk-f7bn
1
vulnerability VCID-1uv2-rvmy-53hk
2
vulnerability VCID-4bm7-hbe1-mfca
3
vulnerability VCID-4bzw-ges2-d7ek
4
vulnerability VCID-4ywn-n1my-83ev
5
vulnerability VCID-7hxh-btrk-skhg
6
vulnerability VCID-7uv9-4vy7-ryd1
7
vulnerability VCID-84ge-vq7u-j3ar
8
vulnerability VCID-8cmt-z8g9-duf2
9
vulnerability VCID-8jup-umjw-9ba4
10
vulnerability VCID-9mn7-d2mm-uqay
11
vulnerability VCID-cv6j-98vx-n3ed
12
vulnerability VCID-dbzr-zyeu-73g8
13
vulnerability VCID-dj42-wym9-nbhv
14
vulnerability VCID-dvxu-9sh6-qbef
15
vulnerability VCID-fvde-37ch-z7cg
16
vulnerability VCID-fwkj-x53j-yqd8
17
vulnerability VCID-ghqg-ae1b-w7br
18
vulnerability VCID-gvwn-8r4r-47gm
19
vulnerability VCID-hrky-nmnv-g3eu
20
vulnerability VCID-jzbz-jpe1-cycg
21
vulnerability VCID-kmqa-hsqy-muf1
22
vulnerability VCID-m39c-3bv2-6ugy
23
vulnerability VCID-mmth-7rgf-aqfa
24
vulnerability VCID-mvdz-exud-3ybz
25
vulnerability VCID-nm42-xrpq-7ued
26
vulnerability VCID-npge-yn8z-6fac
27
vulnerability VCID-nztp-y8p8-cqc6
28
vulnerability VCID-pdny-erzd-jqhc
29
vulnerability VCID-q2ad-khtm-nqdr
30
vulnerability VCID-renj-v5ce-2khx
31
vulnerability VCID-t1s3-f181-tqca
32
vulnerability VCID-vztu-pap6-37ev
33
vulnerability VCID-wtca-5ffw-w7bc
34
vulnerability VCID-wzez-6cmp-n7gn
35
vulnerability VCID-xgnf-d44x-kfc9
36
vulnerability VCID-xpa5-fsb6-ukay
37
vulnerability VCID-z1jy-4da2-tyhk
38
vulnerability VCID-z6wr-3psx-dbfm
39
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.14.3
aliases CVE-2013-1965, GHSA-whmq-v94q-34p9
risk_score 10.0
exploitability 2.0
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-447s-4ag7-gyes
4
url VCID-4bm7-hbe1-mfca
vulnerability_id VCID-4bm7-hbe1-mfca
summary 
Unrestricted Upload of File with Dangerous Type
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2012-1592
reference_id
reference_type
scores
0
value 0.00588
scoring_system epss
scoring_elements 0.69513
published_at 2026-06-04T12:55:00Z
1
value 0.00588
scoring_system epss
scoring_elements 0.69552
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2012-1592
1
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1592
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1592
2
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
3
reference_url https://github.com/apache/struts/blob/master/core/src/main/resources/struts-default.xml#L39-L76
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/blob/master/core/src/main/resources/struts-default.xml#L39-L76
4
reference_url https://issues.apache.org/jira/browse/WW-5055
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://issues.apache.org/jira/browse/WW-5055
5
reference_url https://lists.apache.org/thread.html/r348ed455a140273c40b974f0615dee692f7c9b26c6de2118b4280ef2@%3Cissues.struts.apache.org%3E
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r348ed455a140273c40b974f0615dee692f7c9b26c6de2118b4280ef2@%3Cissues.struts.apache.org%3E
6
reference_url https://lists.apache.org/thread.html/r348ed455a140273c40b974f0615dee692f7c9b26c6de2118b4280ef2%40%3Cissues.struts.apache.org%3E
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r348ed455a140273c40b974f0615dee692f7c9b26c6de2118b4280ef2%40%3Cissues.struts.apache.org%3E
7
reference_url https://lists.apache.org/thread.html/r593ebb2f4c95b064e6901fd273eff256c493db952bdb484395948ffc@%3Cissues.struts.apache.org%3E
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r593ebb2f4c95b064e6901fd273eff256c493db952bdb484395948ffc@%3Cissues.struts.apache.org%3E
8
reference_url https://lists.apache.org/thread.html/r593ebb2f4c95b064e6901fd273eff256c493db952bdb484395948ffc%40%3Cissues.struts.apache.org%3E
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r593ebb2f4c95b064e6901fd273eff256c493db952bdb484395948ffc%40%3Cissues.struts.apache.org%3E
9
reference_url https://lists.apache.org/thread.html/r93c4e3f6cb138cd117c739714f07e47af547183ba099ba46be2b2a5b@%3Cissues.struts.apache.org%3E
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r93c4e3f6cb138cd117c739714f07e47af547183ba099ba46be2b2a5b@%3Cissues.struts.apache.org%3E
10
reference_url https://lists.apache.org/thread.html/r93c4e3f6cb138cd117c739714f07e47af547183ba099ba46be2b2a5b%40%3Cissues.struts.apache.org%3E
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r93c4e3f6cb138cd117c739714f07e47af547183ba099ba46be2b2a5b%40%3Cissues.struts.apache.org%3E
11
reference_url https://seclists.org/bugtraq/2012/Mar/110
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://seclists.org/bugtraq/2012/Mar/110
12
reference_url https://struts.apache.org/security/#internal-security-mechanism
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://struts.apache.org/security/#internal-security-mechanism
13
reference_url https://www.openwall.com/lists/oss-security/2012/03/28/12
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.openwall.com/lists/oss-security/2012/03/28/12
14
reference_url http://www.openwall.com/lists/oss-security/2012/03/28/12
reference_id
reference_type
scores
url http://www.openwall.com/lists/oss-security/2012/03/28/12
15
reference_url https://access.redhat.com/security/cve/cve-2012-1592
reference_id CVE-2012-1592
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/security/cve/cve-2012-1592
16
reference_url https://nvd.nist.gov/vuln/detail/CVE-2012-1592
reference_id CVE-2012-1592
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2012-1592
17
reference_url https://security-tracker.debian.org/tracker/CVE-2012-1592
reference_id CVE-2012-1592
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://security-tracker.debian.org/tracker/CVE-2012-1592
18
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/java/webapps/37009.xml
reference_id CVE-2012-1592;OSVDB-80547
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/java/webapps/37009.xml
19
reference_url https://www.securityfocus.com/bid/52702/info
reference_id CVE-2012-1592;OSVDB-80547
reference_type exploit
scores
url https://www.securityfocus.com/bid/52702/info
20
reference_url https://github.com/advisories/GHSA-8m5q-crqq-6pmf
reference_id GHSA-8m5q-crqq-6pmf
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-8m5q-crqq-6pmf
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.5.22
purl pkg:maven/org.apache.struts/struts2-core@2.5.22
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8cmt-z8g9-duf2
1
vulnerability VCID-dbzr-zyeu-73g8
2
vulnerability VCID-gvwn-8r4r-47gm
3
vulnerability VCID-mvdz-exud-3ybz
4
vulnerability VCID-nztp-y8p8-cqc6
5
vulnerability VCID-renj-v5ce-2khx
6
vulnerability VCID-wzez-6cmp-n7gn
7
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5.22
aliases CVE-2012-1592, GHSA-8m5q-crqq-6pmf
risk_score 10.0
exploitability 2.0
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4bm7-hbe1-mfca
5
url VCID-4bzw-ges2-d7ek
vulnerability_id VCID-4bzw-ges2-d7ek
summary 
Apache Struts forced double OGNL evaluation
Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-4461
reference_id
reference_type
scores
0
value 0.01142
scoring_system epss
scoring_elements 0.78796
published_at 2026-06-05T12:55:00Z
1
value 0.01142
scoring_system epss
scoring_elements 0.78771
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-4461
1
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
2
reference_url https://security.netapp.com/advisory/ntap-20180629-0004
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20180629-0004
3
reference_url https://struts.apache.org/docs/s2-036.html
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://struts.apache.org/docs/s2-036.html
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-4461
reference_id CVE-2016-4461
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-4461
5
reference_url https://github.com/advisories/GHSA-864w-r5qj-h6fj
reference_id GHSA-864w-r5qj-h6fj
reference_type
scores
url https://github.com/advisories/GHSA-864w-r5qj-h6fj
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.29
purl pkg:maven/org.apache.struts/struts2-core@2.3.29
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-7hxh-btrk-skhg
2
vulnerability VCID-7uv9-4vy7-ryd1
3
vulnerability VCID-8cmt-z8g9-duf2
4
vulnerability VCID-cv6j-98vx-n3ed
5
vulnerability VCID-dbzr-zyeu-73g8
6
vulnerability VCID-dj42-wym9-nbhv
7
vulnerability VCID-dvxu-9sh6-qbef
8
vulnerability VCID-gvwn-8r4r-47gm
9
vulnerability VCID-hrky-nmnv-g3eu
10
vulnerability VCID-mmth-7rgf-aqfa
11
vulnerability VCID-mvdz-exud-3ybz
12
vulnerability VCID-nm42-xrpq-7ued
13
vulnerability VCID-nztp-y8p8-cqc6
14
vulnerability VCID-renj-v5ce-2khx
15
vulnerability VCID-vztu-pap6-37ev
16
vulnerability VCID-wzez-6cmp-n7gn
17
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.29
aliases CVE-2016-4461, GHSA-864w-r5qj-h6fj
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4bzw-ges2-d7ek
6
url VCID-4ywn-n1my-83ev
vulnerability_id VCID-4ywn-n1my-83ev
summary 
Improper Input Validation
The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-3090
reference_id
reference_type
scores
0
value 0.02195
scoring_system epss
scoring_elements 0.8471
published_at 2026-06-04T12:55:00Z
1
value 0.02195
scoring_system epss
scoring_elements 0.84734
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-3090
1
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
2
reference_url https://security.netapp.com/advisory/ntap-20180629-0005
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20180629-0005
3
reference_url https://security.netapp.com/advisory/ntap-20180629-0005/
reference_id
reference_type
scores
url https://security.netapp.com/advisory/ntap-20180629-0005/
4
reference_url https://struts.apache.org/docs/s2-027.html
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://struts.apache.org/docs/s2-027.html
5
reference_url https://web.archive.org/web/20210123095942/http://www.securityfocus.com/bid/85131
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20210123095942/http://www.securityfocus.com/bid/85131
6
reference_url https://web.archive.org/web/20211206100940/https://www.securitytracker.com/id/1035267
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20211206100940/https://www.securitytracker.com/id/1035267
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-3090
reference_id CVE-2016-3090
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-3090
8
reference_url https://github.com/advisories/GHSA-ggmp-fxfg-277r
reference_id GHSA-ggmp-fxfg-277r
reference_type
scores
url https://github.com/advisories/GHSA-ggmp-fxfg-277r
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.20
purl pkg:maven/org.apache.struts/struts2-core@2.3.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1cxn-qv1w-2kh7
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-4bzw-ges2-d7ek
3
vulnerability VCID-4t8h-s9mh-p7c4
4
vulnerability VCID-6dfe-8yy4-kkfj
5
vulnerability VCID-7hxh-btrk-skhg
6
vulnerability VCID-7uv9-4vy7-ryd1
7
vulnerability VCID-8cmt-z8g9-duf2
8
vulnerability VCID-9mn7-d2mm-uqay
9
vulnerability VCID-cv6j-98vx-n3ed
10
vulnerability VCID-dbzr-zyeu-73g8
11
vulnerability VCID-dj42-wym9-nbhv
12
vulnerability VCID-dvxu-9sh6-qbef
13
vulnerability VCID-fwkj-x53j-yqd8
14
vulnerability VCID-gvwn-8r4r-47gm
15
vulnerability VCID-hrky-nmnv-g3eu
16
vulnerability VCID-jzbz-jpe1-cycg
17
vulnerability VCID-mmth-7rgf-aqfa
18
vulnerability VCID-mvdz-exud-3ybz
19
vulnerability VCID-nm42-xrpq-7ued
20
vulnerability VCID-npge-yn8z-6fac
21
vulnerability VCID-nztp-y8p8-cqc6
22
vulnerability VCID-pdny-erzd-jqhc
23
vulnerability VCID-q2ad-khtm-nqdr
24
vulnerability VCID-qdsq-8td3-5qa1
25
vulnerability VCID-renj-v5ce-2khx
26
vulnerability VCID-vztu-pap6-37ev
27
vulnerability VCID-wzez-6cmp-n7gn
28
vulnerability VCID-xgnf-d44x-kfc9
29
vulnerability VCID-z1jy-4da2-tyhk
30
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.20
aliases CVE-2016-3090, GHSA-ggmp-fxfg-277r
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4ywn-n1my-83ev
7
url VCID-7hxh-btrk-skhg
vulnerability_id VCID-7hxh-btrk-skhg
summary 
Improperly Controlled Modification of Dynamically-Determined Object Attributes
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
references
0
reference_url http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html
1
reference_url http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html
2
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-0230.json
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-0230.json
3
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-0230
reference_id
reference_type
scores
0
value 0.93849
scoring_system epss
scoring_elements 0.99876
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-0230
4
reference_url https://cwiki.apache.org/confluence/display/ww/s2-059
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://cwiki.apache.org/confluence/display/ww/s2-059
5
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
6
reference_url https://launchpad.support.sap.com/#/notes/2982840
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://launchpad.support.sap.com/#/notes/2982840
7
reference_url https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7@%3Cannounce.apache.org%3E
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7@%3Cannounce.apache.org%3E
8
reference_url https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922@%3Cannounce.apache.org%3E
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922@%3Cannounce.apache.org%3E
9
reference_url https://www.oracle.com/security-alerts/cpuApr2021.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpuApr2021.html
10
reference_url https://www.oracle.com/security-alerts/cpujan2021.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpujan2021.html
11
reference_url https://www.oracle.com/security-alerts/cpuoct2021.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpuoct2021.html
12
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1869672
reference_id 1869672
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1869672
13
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/49068.py
reference_id CVE-2019-0230
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/49068.py
14
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-0230
reference_id CVE-2019-0230
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-0230
15
reference_url https://github.com/advisories/GHSA-wp4h-pvgw-5727
reference_id GHSA-wp4h-pvgw-5727
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-wp4h-pvgw-5727
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.5.22
purl pkg:maven/org.apache.struts/struts2-core@2.5.22
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8cmt-z8g9-duf2
1
vulnerability VCID-dbzr-zyeu-73g8
2
vulnerability VCID-gvwn-8r4r-47gm
3
vulnerability VCID-mvdz-exud-3ybz
4
vulnerability VCID-nztp-y8p8-cqc6
5
vulnerability VCID-renj-v5ce-2khx
6
vulnerability VCID-wzez-6cmp-n7gn
7
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5.22
aliases CVE-2019-0230, GHSA-wp4h-pvgw-5727
risk_score 10.0
exploitability 2.0
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-7hxh-btrk-skhg
8
url VCID-7uv9-4vy7-ryd1
vulnerability_id VCID-7uv9-4vy7-ryd1
summary 
Apache Struts vulnerable to remote command execution (RCE) due to improper input validation
Apache Struts contains a Remote Code Execution when using results with no namespace and it's upper actions have no or wildcard namespace. The same flaw exists when using a url tag with no value, action set,  and it's upper actions have no or wildcard namespace.
references
0
reference_url http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.html
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:01:33Z/
url http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.html
1
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-11776.json
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-11776.json
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-11776
reference_id
reference_type
scores
0
value 0.94431
scoring_system epss
scoring_elements 0.99987
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-11776
3
reference_url https://cwiki.apache.org/confluence/display/WW/S2-057
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:01:33Z/
url https://cwiki.apache.org/confluence/display/WW/S2-057
4
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
5
reference_url https://github.com/apache/struts/commit/4a3917176de2df7f33a85511d067f31e50dcc1b
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/4a3917176de2df7f33a85511d067f31e50dcc1b
6
reference_url https://github.com/apache/struts/commit/6e87474f9ad0549f07dd2c37d50a9ccd0977c6e
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/6e87474f9ad0549f07dd2c37d50a9ccd0977c6e
7
reference_url https://github.com/apache/struts/commit/6efaf900d4ffb7be8a74065af5553bad2389f72
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/6efaf900d4ffb7be8a74065af5553bad2389f72
8
reference_url https://github.com/apache/struts/commit/b3bad5ea44f3fd9edb2cb491192c5900f46d45d
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/b3bad5ea44f3fd9edb2cb491192c5900f46d45d
9
reference_url https://lgtm.com/blog/apache_struts_CVE-2018-11776
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:01:33Z/
url https://lgtm.com/blog/apache_struts_CVE-2018-11776
10
reference_url https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E
11
reference_url https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:01:33Z/
url https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
12
reference_url https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:01:33Z/
url https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012
13
reference_url https://security.netapp.com/advisory/ntap-20180822-0001
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20180822-0001
14
reference_url https://security.netapp.com/advisory/ntap-20181018-0002
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20181018-0002
15
reference_url https://web.archive.org/web/20180822160726/http://www.securityfocus.com/bid/105125
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20180822160726/http://www.securityfocus.com/bid/105125
16
reference_url https://web.archive.org/web/20200807025819/http://www.securitytracker.com/id/1041888
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200807025819/http://www.securitytracker.com/id/1041888
17
reference_url https://web.archive.org/web/20201208145803/https://securitytracker.com/id/1041547
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20201208145803/https://securitytracker.com/id/1041547
18
reference_url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-11776
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-11776
19
reference_url https://www.exploit-db.com/exploits/45260
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.exploit-db.com/exploits/45260
20
reference_url https://www.exploit-db.com/exploits/45262
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.exploit-db.com/exploits/45262
21
reference_url https://www.exploit-db.com/exploits/45367
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.exploit-db.com/exploits/45367
22
reference_url https://www.oracle.com/security-alerts/cpujul2020.html
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:01:33Z/
url https://www.oracle.com/security-alerts/cpujul2020.html
23
reference_url https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:01:33Z/
url https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
24
reference_url http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:01:33Z/
url http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt
25
reference_url http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.html
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:01:33Z/
url http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.html
26
reference_url http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:01:33Z/
url http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
27
reference_url http://www.securityfocus.com/bid/105125
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:01:33Z/
url http://www.securityfocus.com/bid/105125
28
reference_url http://www.securitytracker.com/id/1041547
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:01:33Z/
url http://www.securitytracker.com/id/1041547
29
reference_url http://www.securitytracker.com/id/1041888
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:01:33Z/
url http://www.securitytracker.com/id/1041888
30
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1620019
reference_id 1620019
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1620019
31
reference_url https://www.exploit-db.com/exploits/45260/
reference_id 45260
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:01:33Z/
url https://www.exploit-db.com/exploits/45260/
32
reference_url https://www.exploit-db.com/exploits/45262/
reference_id 45262
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:01:33Z/
url https://www.exploit-db.com/exploits/45262/
33
reference_url https://www.exploit-db.com/exploits/45367/
reference_id 45367
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:01:33Z/
url https://www.exploit-db.com/exploits/45367/
34
reference_url https://github.com/hook-s3c/CVE-2018-11776-Python-PoC/blob/343bf070cc8649803ea865bd64543234fec1a4f6/exploitS2-057-cmd.py
reference_id CVE-2018-11776
reference_type exploit
scores
url https://github.com/hook-s3c/CVE-2018-11776-Python-PoC/blob/343bf070cc8649803ea865bd64543234fec1a4f6/exploitS2-057-cmd.py
35
reference_url https://github.com/mazen160/struts-pwn_CVE-2018-11776/blob/ffaefa75242315913a8f695b6d5eab8b6143794d/struts-pwn.py
reference_id CVE-2018-11776
reference_type exploit
scores
url https://github.com/mazen160/struts-pwn_CVE-2018-11776/blob/ffaefa75242315913a8f695b6d5eab8b6143794d/struts-pwn.py
36
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/45260.py
reference_id CVE-2018-11776
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/45260.py
37
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/45262.py
reference_id CVE-2018-11776
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/45262.py
38
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/45367.rb
reference_id CVE-2018-11776
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/45367.rb
39
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-11776
reference_id CVE-2018-11776
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2018-11776
40
reference_url https://raw.githubusercontent.com/rapid7/metasploit-framework/718aaca0f4a25827695d643568beaa784ff21518/modules/exploits/multi/http/struts2_namespace_ognl.rb
reference_id CVE-2018-11776
reference_type exploit
scores
url https://raw.githubusercontent.com/rapid7/metasploit-framework/718aaca0f4a25827695d643568beaa784ff21518/modules/exploits/multi/http/struts2_namespace_ognl.rb
41
reference_url https://github.com/hook-s3c/CVE-2018-11776-Python-PoC
reference_id CVE-2018-11776-PYTHON-POC
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:01:33Z/
url https://github.com/hook-s3c/CVE-2018-11776-Python-PoC
42
reference_url https://github.com/advisories/GHSA-cr6j-3jp9-rw65
reference_id GHSA-cr6j-3jp9-rw65
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-cr6j-3jp9-rw65
43
reference_url https://security.netapp.com/advisory/ntap-20180822-0001/
reference_id ntap-20180822-0001
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value Attend
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:01:33Z/
url https://security.netapp.com/advisory/ntap-20180822-0001/
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.35
purl pkg:maven/org.apache.struts/struts2-core@2.3.35
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-7hxh-btrk-skhg
2
vulnerability VCID-8cmt-z8g9-duf2
3
vulnerability VCID-dbzr-zyeu-73g8
4
vulnerability VCID-dj42-wym9-nbhv
5
vulnerability VCID-gvwn-8r4r-47gm
6
vulnerability VCID-mvdz-exud-3ybz
7
vulnerability VCID-nm42-xrpq-7ued
8
vulnerability VCID-nztp-y8p8-cqc6
9
vulnerability VCID-renj-v5ce-2khx
10
vulnerability VCID-wzez-6cmp-n7gn
11
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.35
1
url pkg:maven/org.apache.struts/struts2-core@2.5.17
purl pkg:maven/org.apache.struts/struts2-core@2.5.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-7hxh-btrk-skhg
2
vulnerability VCID-8cmt-z8g9-duf2
3
vulnerability VCID-dbzr-zyeu-73g8
4
vulnerability VCID-gvwn-8r4r-47gm
5
vulnerability VCID-mvdz-exud-3ybz
6
vulnerability VCID-nm42-xrpq-7ued
7
vulnerability VCID-nztp-y8p8-cqc6
8
vulnerability VCID-renj-v5ce-2khx
9
vulnerability VCID-wzez-6cmp-n7gn
10
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5.17
aliases CVE-2018-11776, GHSA-cr6j-3jp9-rw65
risk_score 10.0
exploitability 2.0
weighted_severity 8.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-7uv9-4vy7-ryd1
9
url VCID-84ge-vq7u-j3ar
vulnerability_id VCID-84ge-vq7u-j3ar
summary 
Incomplete fix for ClassLoader manipulation via ParametersInterceptor
The `ParametersInterceptor` in this package allows remote attackers to `manipulate` the `ClassLoader` via the class parameter, which is passed to the getClass method.
references
0
reference_url http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045
1
reference_url http://jvn.jp/en/jp/JVN19294237/index.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://jvn.jp/en/jp/JVN19294237/index.html
2
reference_url http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
3
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0094.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0094.json
4
reference_url https://api.first.org/data/v1/epss?cve=CVE-2014-0094
reference_id
reference_type
scores
0
value 0.93134
scoring_system epss
scoring_elements 0.99801
published_at 2026-06-05T12:55:00Z
1
value 0.93134
scoring_system epss
scoring_elements 0.998
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2014-0094
5
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
6
reference_url https://github.com/apache/struts/commit/2e2da292166adbc78c4cb1e308b30ddb4fba6d3f
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/2e2da292166adbc78c4cb1e308b30ddb4fba6d3f
7
reference_url https://github.com/apache/struts/commit/6315241719be167542962da436b38782ed730c62
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/6315241719be167542962da436b38782ed730c62
8
reference_url https://github.com/apache/struts/commit/74e26830d2849a84729b33497f729e0f033dc147
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/74e26830d2849a84729b33497f729e0f033dc147
9
reference_url http://struts.apache.org/docs/s2-021.html
reference_id
reference_type
scores
url http://struts.apache.org/docs/s2-021.html
10
reference_url http://struts.apache.org/release/2.3.x/docs/s2-020.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://struts.apache.org/release/2.3.x/docs/s2-020.html
11
reference_url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0094
reference_id
reference_type
scores
url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0094
12
reference_url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0113
reference_id
reference_type
scores
url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0113
13
reference_url http://www-01.ibm.com/support/docview.wss?uid=swg21676706
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www-01.ibm.com/support/docview.wss?uid=swg21676706
14
reference_url http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
15
reference_url http://www.konakart.com/downloads/ver-7-3-0-0-whats-new
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.konakart.com/downloads/ver-7-3-0-0-whats-new
16
reference_url http://www.vmware.com/security/advisories/VMSA-2014-0007.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.vmware.com/security/advisories/VMSA-2014-0007.html
17
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1073716
reference_id 1073716
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1073716
18
reference_url https://nvd.nist.gov/vuln/detail/CVE-2014-0094
reference_id CVE-2014-0094
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2014-0094
19
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/33142.rb
reference_id CVE-2014-0113;CVE-2014-0112;CVE-2014-0094;OSVDB-103918
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/33142.rb
20
reference_url https://github.com/rapid7/metasploit-framework/blob/3123175ac75c38bec5165e01cda05e3b38287003/modules/exploits/multi/http/struts_code_exec_classloader.rb
reference_id CVE-2014-0114;CVE-2014-0112;CVE-2014-0094
reference_type exploit
scores
url https://github.com/rapid7/metasploit-framework/blob/3123175ac75c38bec5165e01cda05e3b38287003/modules/exploits/multi/http/struts_code_exec_classloader.rb
21
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/41690.rb
reference_id CVE-2014-0114;CVE-2014-0112;CVE-2014-0094
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/41690.rb
22
reference_url https://github.com/advisories/GHSA-vrwc-qjmw-5rjm
reference_id GHSA-vrwc-qjmw-5rjm
reference_type
scores
url https://github.com/advisories/GHSA-vrwc-qjmw-5rjm
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.16.2
purl pkg:maven/org.apache.struts/struts2-core@2.3.16.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-4bzw-ges2-d7ek
2
vulnerability VCID-4ywn-n1my-83ev
3
vulnerability VCID-7hxh-btrk-skhg
4
vulnerability VCID-7uv9-4vy7-ryd1
5
vulnerability VCID-8cmt-z8g9-duf2
6
vulnerability VCID-9mn7-d2mm-uqay
7
vulnerability VCID-cv6j-98vx-n3ed
8
vulnerability VCID-dbzr-zyeu-73g8
9
vulnerability VCID-dj42-wym9-nbhv
10
vulnerability VCID-dvxu-9sh6-qbef
11
vulnerability VCID-fwkj-x53j-yqd8
12
vulnerability VCID-ghqg-ae1b-w7br
13
vulnerability VCID-gvwn-8r4r-47gm
14
vulnerability VCID-hrky-nmnv-g3eu
15
vulnerability VCID-jzbz-jpe1-cycg
16
vulnerability VCID-m39c-3bv2-6ugy
17
vulnerability VCID-mmth-7rgf-aqfa
18
vulnerability VCID-mvdz-exud-3ybz
19
vulnerability VCID-nm42-xrpq-7ued
20
vulnerability VCID-npge-yn8z-6fac
21
vulnerability VCID-nztp-y8p8-cqc6
22
vulnerability VCID-pdny-erzd-jqhc
23
vulnerability VCID-q2ad-khtm-nqdr
24
vulnerability VCID-renj-v5ce-2khx
25
vulnerability VCID-t1s3-f181-tqca
26
vulnerability VCID-vztu-pap6-37ev
27
vulnerability VCID-wtca-5ffw-w7bc
28
vulnerability VCID-wzez-6cmp-n7gn
29
vulnerability VCID-xgnf-d44x-kfc9
30
vulnerability VCID-z1jy-4da2-tyhk
31
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.16.2
aliases CVE-2014-0094, GHSA-vrwc-qjmw-5rjm
risk_score 10.0
exploitability 2.0
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-84ge-vq7u-j3ar
10
url VCID-89az-256b-mubw
vulnerability_id VCID-89az-256b-mubw
summary 
Code Injection
Apache Struts 2 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-2134
reference_id
reference_type
scores
0
value 0.90936
scoring_system epss
scoring_elements 0.99649
published_at 2026-06-05T12:55:00Z
1
value 0.90936
scoring_system epss
scoring_elements 0.99648
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-2134
1
reference_url https://cwiki.apache.org/confluence/display/WW/S2-015
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://cwiki.apache.org/confluence/display/WW/S2-015
2
reference_url http://security.gentoo.org/glsa/glsa-201409-04.xml
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://security.gentoo.org/glsa/glsa-201409-04.xml
3
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
4
reference_url https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e
5
reference_url https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e0
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e0
6
reference_url https://github.com/apache/struts/commit/041206d2a693d02c0cb2e72765275e55ba14049f
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/041206d2a693d02c0cb2e72765275e55ba14049f
7
reference_url https://github.com/apache/struts/commit/113c47082c09818bcef65acc436a2d0c7c47aa6c
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/113c47082c09818bcef65acc436a2d0c7c47aa6c
8
reference_url https://github.com/apache/struts/commit/54e5c912ebd9a1599bfcf7a719da17c28127bbe
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/54e5c912ebd9a1599bfcf7a719da17c28127bbe
9
reference_url https://github.com/apache/struts/commit/54e5c912ebd9a1599bfcf7a719da17c28127bbe3
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/54e5c912ebd9a1599bfcf7a719da17c28127bbe3
10
reference_url https://github.com/apache/struts/commit/711cf0201cdd319a38cf29238913312355db29ba
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/711cf0201cdd319a38cf29238913312355db29ba
11
reference_url https://github.com/apache/struts/commit/8b4fc81daeea3834bcbf73de5f48d0021917aa3
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/8b4fc81daeea3834bcbf73de5f48d0021917aa3
12
reference_url https://github.com/apache/struts/commit/8b4fc81daeea3834bcbf73de5f48d0021917aa37
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/8b4fc81daeea3834bcbf73de5f48d0021917aa37
13
reference_url https://github.com/apache/struts/commit/cfb6e9afbae320a4dd5bdd655154ab9fe5a92c1
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/cfb6e9afbae320a4dd5bdd655154ab9fe5a92c1
14
reference_url https://github.com/apache/struts/commit/cfb6e9afbae320a4dd5bdd655154ab9fe5a92c16
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/cfb6e9afbae320a4dd5bdd655154ab9fe5a92c16
15
reference_url https://issues.apache.org/jira/browse/WW-4090
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://issues.apache.org/jira/browse/WW-4090
16
reference_url https://issues.apache.org/jira/browse/WW-4094
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://issues.apache.org/jira/browse/WW-4094
17
reference_url https://issues.apache.org/jira/browse/WW-4095
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://issues.apache.org/jira/browse/WW-4095
18
reference_url http://struts.apache.org/development/2.x/docs/s2-015.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://struts.apache.org/development/2.x/docs/s2-015.html
19
reference_url http://struts.apache.org/docs/s2-015.html
reference_id
reference_type
scores
url http://struts.apache.org/docs/s2-015.html
20
reference_url https://web.archive.org/web/20140226173351/http://www.securityfocus.com/bid/60346
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20140226173351/http://www.securityfocus.com/bid/60346
21
reference_url https://web.archive.org/web/20140410223942/http://www.securityfocus.com/bid/64758
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20140410223942/http://www.securityfocus.com/bid/64758
22
reference_url http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
23
reference_url http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
24
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-2134
reference_id CVE-2013-2134
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-2134
25
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/38549.txt
reference_id CVE-2013-2134;OSVDB-93969
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/38549.txt
26
reference_url https://www.securityfocus.com/bid/60345/info
reference_id CVE-2013-2134;OSVDB-93969
reference_type exploit
scores
url https://www.securityfocus.com/bid/60345/info
27
reference_url https://github.com/advisories/GHSA-gqqm-564f-vvxq
reference_id GHSA-gqqm-564f-vvxq
reference_type
scores
url https://github.com/advisories/GHSA-gqqm-564f-vvxq
28
reference_url https://security.gentoo.org/glsa/201409-04
reference_id GLSA-201409-04
reference_type
scores
url https://security.gentoo.org/glsa/201409-04
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.14.3
purl pkg:maven/org.apache.struts/struts2-core@2.3.14.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1exe-1vfk-f7bn
1
vulnerability VCID-1uv2-rvmy-53hk
2
vulnerability VCID-4bm7-hbe1-mfca
3
vulnerability VCID-4bzw-ges2-d7ek
4
vulnerability VCID-4ywn-n1my-83ev
5
vulnerability VCID-7hxh-btrk-skhg
6
vulnerability VCID-7uv9-4vy7-ryd1
7
vulnerability VCID-84ge-vq7u-j3ar
8
vulnerability VCID-8cmt-z8g9-duf2
9
vulnerability VCID-8jup-umjw-9ba4
10
vulnerability VCID-9mn7-d2mm-uqay
11
vulnerability VCID-cv6j-98vx-n3ed
12
vulnerability VCID-dbzr-zyeu-73g8
13
vulnerability VCID-dj42-wym9-nbhv
14
vulnerability VCID-dvxu-9sh6-qbef
15
vulnerability VCID-fvde-37ch-z7cg
16
vulnerability VCID-fwkj-x53j-yqd8
17
vulnerability VCID-ghqg-ae1b-w7br
18
vulnerability VCID-gvwn-8r4r-47gm
19
vulnerability VCID-hrky-nmnv-g3eu
20
vulnerability VCID-jzbz-jpe1-cycg
21
vulnerability VCID-kmqa-hsqy-muf1
22
vulnerability VCID-m39c-3bv2-6ugy
23
vulnerability VCID-mmth-7rgf-aqfa
24
vulnerability VCID-mvdz-exud-3ybz
25
vulnerability VCID-nm42-xrpq-7ued
26
vulnerability VCID-npge-yn8z-6fac
27
vulnerability VCID-nztp-y8p8-cqc6
28
vulnerability VCID-pdny-erzd-jqhc
29
vulnerability VCID-q2ad-khtm-nqdr
30
vulnerability VCID-renj-v5ce-2khx
31
vulnerability VCID-t1s3-f181-tqca
32
vulnerability VCID-vztu-pap6-37ev
33
vulnerability VCID-wtca-5ffw-w7bc
34
vulnerability VCID-wzez-6cmp-n7gn
35
vulnerability VCID-xgnf-d44x-kfc9
36
vulnerability VCID-xpa5-fsb6-ukay
37
vulnerability VCID-z1jy-4da2-tyhk
38
vulnerability VCID-z6wr-3psx-dbfm
39
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.14.3
aliases CVE-2013-2134, GHSA-gqqm-564f-vvxq
risk_score 10.0
exploitability 2.0
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-89az-256b-mubw
11
url VCID-8cmt-z8g9-duf2
vulnerability_id VCID-8cmt-z8g9-duf2
summary 
Apache Struts 2 is Missing XML Validation
Missing XML Validation vulnerability in Apache Struts, Apache Struts.

This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.

Users are recommended to upgrade to version 6.1.1, which fixes the issue.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68493.json
reference_id
reference_type
scores
0
value 7.1
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68493.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-68493
reference_id
reference_type
scores
0
value 0.00033
scoring_system epss
scoring_elements 0.10211
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-68493
2
reference_url https://cwiki.apache.org/confluence/display/WW/S2-069
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-12T13:52:42Z/
url https://cwiki.apache.org/confluence/display/WW/S2-069
3
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
4
reference_url http://www.openwall.com/lists/oss-security/2026/01/11/2
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2026/01/11/2
5
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2428559
reference_id 2428559
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2428559
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-68493
reference_id CVE-2025-68493
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-68493
7
reference_url https://github.com/advisories/GHSA-qcfc-hmrc-59x7
reference_id GHSA-qcfc-hmrc-59x7
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-qcfc-hmrc-59x7
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.5-BETA1
purl pkg:maven/org.apache.struts/struts2-core@2.5-BETA1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-7hxh-btrk-skhg
2
vulnerability VCID-dbzr-zyeu-73g8
3
vulnerability VCID-dj42-wym9-nbhv
4
vulnerability VCID-gvwn-8r4r-47gm
5
vulnerability VCID-jzbz-jpe1-cycg
6
vulnerability VCID-mvdz-exud-3ybz
7
vulnerability VCID-nm42-xrpq-7ued
8
vulnerability VCID-nztp-y8p8-cqc6
9
vulnerability VCID-renj-v5ce-2khx
10
vulnerability VCID-wzez-6cmp-n7gn
11
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5-BETA1
1
url pkg:maven/org.apache.struts/struts2-core@6.1.1
purl pkg:maven/org.apache.struts/struts2-core@6.1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gvwn-8r4r-47gm
1
vulnerability VCID-mvdz-exud-3ybz
2
vulnerability VCID-renj-v5ce-2khx
3
vulnerability VCID-wzez-6cmp-n7gn
4
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@6.1.1
aliases CVE-2025-68493, GHSA-qcfc-hmrc-59x7
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-8cmt-z8g9-duf2
12
url VCID-8jup-umjw-9ba4
vulnerability_id VCID-8jup-umjw-9ba4
summary 
Classloader manipulation via CookieInterceptor
CookieInterceptor in this package, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0113.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0113.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2014-0113
reference_id
reference_type
scores
0
value 0.82224
scoring_system epss
scoring_elements 0.99238
published_at 2026-06-04T12:55:00Z
1
value 0.82224
scoring_system epss
scoring_elements 0.99239
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2014-0113
2
reference_url https://cwiki.apache.org/confluence/display/WW/S2-021
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://cwiki.apache.org/confluence/display/WW/S2-021
3
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
4
reference_url https://github.com/apache/struts/commit/74e26830d2849a84729b33497f729e0f033dc147
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/74e26830d2849a84729b33497f729e0f033dc147
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2014-0113
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2014-0113
6
reference_url http://struts.apache.org/docs/s2-021.html
reference_id
reference_type
scores
url http://struts.apache.org/docs/s2-021.html
7
reference_url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0113
reference_id
reference_type
scores
url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0113
8
reference_url http://www-01.ibm.com/support/docview.wss?uid=swg21676706
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www-01.ibm.com/support/docview.wss?uid=swg21676706
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1092201
reference_id 1092201
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1092201
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.16.2
purl pkg:maven/org.apache.struts/struts2-core@2.3.16.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-4bzw-ges2-d7ek
2
vulnerability VCID-4ywn-n1my-83ev
3
vulnerability VCID-7hxh-btrk-skhg
4
vulnerability VCID-7uv9-4vy7-ryd1
5
vulnerability VCID-8cmt-z8g9-duf2
6
vulnerability VCID-9mn7-d2mm-uqay
7
vulnerability VCID-cv6j-98vx-n3ed
8
vulnerability VCID-dbzr-zyeu-73g8
9
vulnerability VCID-dj42-wym9-nbhv
10
vulnerability VCID-dvxu-9sh6-qbef
11
vulnerability VCID-fwkj-x53j-yqd8
12
vulnerability VCID-ghqg-ae1b-w7br
13
vulnerability VCID-gvwn-8r4r-47gm
14
vulnerability VCID-hrky-nmnv-g3eu
15
vulnerability VCID-jzbz-jpe1-cycg
16
vulnerability VCID-m39c-3bv2-6ugy
17
vulnerability VCID-mmth-7rgf-aqfa
18
vulnerability VCID-mvdz-exud-3ybz
19
vulnerability VCID-nm42-xrpq-7ued
20
vulnerability VCID-npge-yn8z-6fac
21
vulnerability VCID-nztp-y8p8-cqc6
22
vulnerability VCID-pdny-erzd-jqhc
23
vulnerability VCID-q2ad-khtm-nqdr
24
vulnerability VCID-renj-v5ce-2khx
25
vulnerability VCID-t1s3-f181-tqca
26
vulnerability VCID-vztu-pap6-37ev
27
vulnerability VCID-wtca-5ffw-w7bc
28
vulnerability VCID-wzez-6cmp-n7gn
29
vulnerability VCID-xgnf-d44x-kfc9
30
vulnerability VCID-z1jy-4da2-tyhk
31
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.16.2
1
url pkg:maven/org.apache.struts/struts2-core@2.3.20
purl pkg:maven/org.apache.struts/struts2-core@2.3.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1cxn-qv1w-2kh7
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-4bzw-ges2-d7ek
3
vulnerability VCID-4t8h-s9mh-p7c4
4
vulnerability VCID-6dfe-8yy4-kkfj
5
vulnerability VCID-7hxh-btrk-skhg
6
vulnerability VCID-7uv9-4vy7-ryd1
7
vulnerability VCID-8cmt-z8g9-duf2
8
vulnerability VCID-9mn7-d2mm-uqay
9
vulnerability VCID-cv6j-98vx-n3ed
10
vulnerability VCID-dbzr-zyeu-73g8
11
vulnerability VCID-dj42-wym9-nbhv
12
vulnerability VCID-dvxu-9sh6-qbef
13
vulnerability VCID-fwkj-x53j-yqd8
14
vulnerability VCID-gvwn-8r4r-47gm
15
vulnerability VCID-hrky-nmnv-g3eu
16
vulnerability VCID-jzbz-jpe1-cycg
17
vulnerability VCID-mmth-7rgf-aqfa
18
vulnerability VCID-mvdz-exud-3ybz
19
vulnerability VCID-nm42-xrpq-7ued
20
vulnerability VCID-npge-yn8z-6fac
21
vulnerability VCID-nztp-y8p8-cqc6
22
vulnerability VCID-pdny-erzd-jqhc
23
vulnerability VCID-q2ad-khtm-nqdr
24
vulnerability VCID-qdsq-8td3-5qa1
25
vulnerability VCID-renj-v5ce-2khx
26
vulnerability VCID-vztu-pap6-37ev
27
vulnerability VCID-wzez-6cmp-n7gn
28
vulnerability VCID-xgnf-d44x-kfc9
29
vulnerability VCID-z1jy-4da2-tyhk
30
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.20
aliases CVE-2014-0113, GHSA-3c5c-xrq4-qhr8
risk_score 10.0
exploitability 2.0
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-8jup-umjw-9ba4
13
url VCID-9mn7-d2mm-uqay
vulnerability_id VCID-9mn7-d2mm-uqay
summary 
Cross-site Scripting
Cross-site scripting (XSS) vulnerability in the `URLDecoder` function in JRE, as used in Apache Struts, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in an url-encoded parameter.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-4003.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-4003.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-4003
reference_id
reference_type
scores
0
value 0.02629
scoring_system epss
scoring_elements 0.85991
published_at 2026-06-05T12:55:00Z
1
value 0.02629
scoring_system epss
scoring_elements 0.85969
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-4003
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.4
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:N/C:P/I:P/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
4
reference_url https://github.com/apache/struts/commit/4720f46a63caaf9db97ba27dc51ac5ad21e66bdc
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/4720f46a63caaf9db97ba27dc51ac5ad21e66bdc
5
reference_url https://github.com/apache/struts/commit/5421930b49822606792f36653b17d3d95ef106f9
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/5421930b49822606792f36653b17d3d95ef106f9
6
reference_url https://github.com/apache/struts/commit/72471d7075681bea52046645ad7aa34e9c53751e
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/72471d7075681bea52046645ad7aa34e9c53751e
7
reference_url https://github.com/apache/struts/commit/76f188406eb9f17a06afcb5f49f0c44d749da0d2
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/76f188406eb9f17a06afcb5f49f0c44d749da0d2
8
reference_url https://github.com/apache/struts/commit/a89bbe22cd2461748d595a89a254de888a415e6c
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/a89bbe22cd2461748d595a89a254de888a415e6c
9
reference_url https://issues.apache.org/jira/browse/WW-4507
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://issues.apache.org/jira/browse/WW-4507
10
reference_url http://struts.apache.org/docs/s2-028.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://struts.apache.org/docs/s2-028.html
11
reference_url https://web.archive.org/web/20161119142317/http://www.securityfocus.com/bid/86311
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20161119142317/http://www.securityfocus.com/bid/86311
12
reference_url https://web.archive.org/web/20161221184936/http://www.securitytracker.com/id/1035268
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20161221184936/http://www.securitytracker.com/id/1035268
13
reference_url http://www.securityfocus.com/bid/86311
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/86311
14
reference_url http://www.securitytracker.com/id/1035268
reference_id
reference_type
scores
url http://www.securitytracker.com/id/1035268
15
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1326725
reference_id 1326725
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1326725
16
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-4003
reference_id CVE-2016-4003
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-4003
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.24.3
purl pkg:maven/org.apache.struts/struts2-core@2.3.24.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-4bzw-ges2-d7ek
2
vulnerability VCID-7hxh-btrk-skhg
3
vulnerability VCID-7uv9-4vy7-ryd1
4
vulnerability VCID-8cmt-z8g9-duf2
5
vulnerability VCID-cv6j-98vx-n3ed
6
vulnerability VCID-dbzr-zyeu-73g8
7
vulnerability VCID-dj42-wym9-nbhv
8
vulnerability VCID-dvxu-9sh6-qbef
9
vulnerability VCID-gvwn-8r4r-47gm
10
vulnerability VCID-hrky-nmnv-g3eu
11
vulnerability VCID-jzbz-jpe1-cycg
12
vulnerability VCID-mmth-7rgf-aqfa
13
vulnerability VCID-mvdz-exud-3ybz
14
vulnerability VCID-nm42-xrpq-7ued
15
vulnerability VCID-npge-yn8z-6fac
16
vulnerability VCID-nztp-y8p8-cqc6
17
vulnerability VCID-pdny-erzd-jqhc
18
vulnerability VCID-qdsq-8td3-5qa1
19
vulnerability VCID-renj-v5ce-2khx
20
vulnerability VCID-vztu-pap6-37ev
21
vulnerability VCID-wzez-6cmp-n7gn
22
vulnerability VCID-xgnf-d44x-kfc9
23
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.24.3
1
url pkg:maven/org.apache.struts/struts2-core@2.3.28
purl pkg:maven/org.apache.struts/struts2-core@2.3.28
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1cxn-qv1w-2kh7
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-4bzw-ges2-d7ek
3
vulnerability VCID-6dfe-8yy4-kkfj
4
vulnerability VCID-7hxh-btrk-skhg
5
vulnerability VCID-7uv9-4vy7-ryd1
6
vulnerability VCID-8cmt-z8g9-duf2
7
vulnerability VCID-cv6j-98vx-n3ed
8
vulnerability VCID-dbzr-zyeu-73g8
9
vulnerability VCID-dj42-wym9-nbhv
10
vulnerability VCID-dvxu-9sh6-qbef
11
vulnerability VCID-gvwn-8r4r-47gm
12
vulnerability VCID-hrky-nmnv-g3eu
13
vulnerability VCID-jzbz-jpe1-cycg
14
vulnerability VCID-mmth-7rgf-aqfa
15
vulnerability VCID-mvdz-exud-3ybz
16
vulnerability VCID-nm42-xrpq-7ued
17
vulnerability VCID-npge-yn8z-6fac
18
vulnerability VCID-nztp-y8p8-cqc6
19
vulnerability VCID-qdsq-8td3-5qa1
20
vulnerability VCID-renj-v5ce-2khx
21
vulnerability VCID-vztu-pap6-37ev
22
vulnerability VCID-wzez-6cmp-n7gn
23
vulnerability VCID-z1jy-4da2-tyhk
24
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.28
aliases CVE-2016-4003, GHSA-m3x6-9v6h-4g28
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-9mn7-d2mm-uqay
14
url VCID-cv6j-98vx-n3ed
vulnerability_id VCID-cv6j-98vx-n3ed
summary 
Path Traversal
In the Convention plugin in Apache Struts, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-6795
reference_id
reference_type
scores
0
value 0.04732
scoring_system epss
scoring_elements 0.89589
published_at 2026-06-04T12:55:00Z
1
value 0.04732
scoring_system epss
scoring_elements 0.89606
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-6795
1
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
2
reference_url https://github.com/apache/struts/commit/030ffa33543f8953306ed0c0dc815c7fb74d7129
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/030ffa33543f8953306ed0c0dc815c7fb74d7129
3
reference_url https://github.com/apache/struts/commit/8e67b9144aa643769b261e2492cb561e04d016ab
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/8e67b9144aa643769b261e2492cb561e04d016ab
4
reference_url https://github.com/apache/struts/commit/c1869f4989942dd33fa4e189e0ac1f766fb5ac14
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/c1869f4989942dd33fa4e189e0ac1f766fb5ac14
5
reference_url https://security.netapp.com/advisory/ntap-20180629-0003
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20180629-0003
6
reference_url https://security.netapp.com/advisory/ntap-20180629-0003/
reference_id
reference_type
scores
url https://security.netapp.com/advisory/ntap-20180629-0003/
7
reference_url https://struts.apache.org/docs/s2-042.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://struts.apache.org/docs/s2-042.html
8
reference_url https://web.archive.org/web/20200227214705/http://www.securityfocus.com/bid/93773
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200227214705/http://www.securityfocus.com/bid/93773
9
reference_url http://www.securityfocus.com/bid/93773
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/93773
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-6795
reference_id CVE-2016-6795
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-6795
11
reference_url https://github.com/advisories/GHSA-44hv-jjx7-qfjg
reference_id GHSA-44hv-jjx7-qfjg
reference_type
scores
url https://github.com/advisories/GHSA-44hv-jjx7-qfjg
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.31
purl pkg:maven/org.apache.struts/struts2-core@2.3.31
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-7hxh-btrk-skhg
2
vulnerability VCID-7uv9-4vy7-ryd1
3
vulnerability VCID-8cmt-z8g9-duf2
4
vulnerability VCID-dbzr-zyeu-73g8
5
vulnerability VCID-dj42-wym9-nbhv
6
vulnerability VCID-dvxu-9sh6-qbef
7
vulnerability VCID-gvwn-8r4r-47gm
8
vulnerability VCID-hrky-nmnv-g3eu
9
vulnerability VCID-mmth-7rgf-aqfa
10
vulnerability VCID-mvdz-exud-3ybz
11
vulnerability VCID-nm42-xrpq-7ued
12
vulnerability VCID-nztp-y8p8-cqc6
13
vulnerability VCID-renj-v5ce-2khx
14
vulnerability VCID-vztu-pap6-37ev
15
vulnerability VCID-wzez-6cmp-n7gn
16
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.31
1
url pkg:maven/org.apache.struts/struts2-core@2.5.5
purl pkg:maven/org.apache.struts/struts2-core@2.5.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-21k4-5a8r-7bd9
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-7hxh-btrk-skhg
3
vulnerability VCID-7uv9-4vy7-ryd1
4
vulnerability VCID-8cmt-z8g9-duf2
5
vulnerability VCID-dbzr-zyeu-73g8
6
vulnerability VCID-dj42-wym9-nbhv
7
vulnerability VCID-dvxu-9sh6-qbef
8
vulnerability VCID-gvwn-8r4r-47gm
9
vulnerability VCID-hrky-nmnv-g3eu
10
vulnerability VCID-mmth-7rgf-aqfa
11
vulnerability VCID-mvdz-exud-3ybz
12
vulnerability VCID-nm42-xrpq-7ued
13
vulnerability VCID-nztp-y8p8-cqc6
14
vulnerability VCID-renj-v5ce-2khx
15
vulnerability VCID-vztu-pap6-37ev
16
vulnerability VCID-wzez-6cmp-n7gn
17
vulnerability VCID-ybuw-727z-r3eb
18
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5.5
aliases CVE-2016-6795, GHSA-44hv-jjx7-qfjg
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cv6j-98vx-n3ed
15
url VCID-dbzr-zyeu-73g8
vulnerability_id VCID-dbzr-zyeu-73g8
summary 
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-31805.json
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-31805.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-31805
reference_id
reference_type
scores
0
value 0.93788
scoring_system epss
scoring_elements 0.99866
published_at 2026-06-05T12:55:00Z
1
value 0.93788
scoring_system epss
scoring_elements 0.99865
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-31805
2
reference_url https://cwiki.apache.org/confluence/display/WW/S2-062
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://cwiki.apache.org/confluence/display/WW/S2-062
3
reference_url https://security.netapp.com/advisory/ntap-20220420-0001
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20220420-0001
4
reference_url https://security.netapp.com/advisory/ntap-20220420-0001/
reference_id
reference_type
scores
url https://security.netapp.com/advisory/ntap-20220420-0001/
5
reference_url https://www.oracle.com/security-alerts/cpujul2022.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpujul2022.html
6
reference_url http://www.openwall.com/lists/oss-security/2022/04/12/6
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2022/04/12/6
7
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2074788
reference_id 2074788
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2074788
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-31805
reference_id CVE-2021-31805
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2021-31805
9
reference_url https://github.com/advisories/GHSA-v8j6-6c2r-r27c
reference_id GHSA-v8j6-6c2r-r27c
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-v8j6-6c2r-r27c
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.5.30
purl pkg:maven/org.apache.struts/struts2-core@2.5.30
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8cmt-z8g9-duf2
1
vulnerability VCID-gvwn-8r4r-47gm
2
vulnerability VCID-mvdz-exud-3ybz
3
vulnerability VCID-renj-v5ce-2khx
4
vulnerability VCID-wzez-6cmp-n7gn
5
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5.30
aliases CVE-2021-31805, GHSA-v8j6-6c2r-r27c
risk_score 10.0
exploitability 2.0
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dbzr-zyeu-73g8
16
url VCID-dj42-wym9-nbhv
vulnerability_id VCID-dj42-wym9-nbhv
summary 
Improper Input Validation
The Apache Struts REST Plugin XStream library allow attackers to perform a DoS attack when using a malicious request with specially crafted XML payload.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-1327.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-1327.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-1327
reference_id
reference_type
scores
0
value 0.0622
scoring_system epss
scoring_elements 0.9105
published_at 2026-06-05T12:55:00Z
1
value 0.0622
scoring_system epss
scoring_elements 0.91037
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-1327
2
reference_url https://cwiki.apache.org/confluence/display/WW/S2-056
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://cwiki.apache.org/confluence/display/WW/S2-056
3
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
4
reference_url https://github.com/apache/struts/commit/4260bee634cb606be6071bce2383fddb510608aa
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/4260bee634cb606be6071bce2383fddb510608aa
5
reference_url https://github.com/apache/struts/commit/67ecf3a21608e20449bcb7895b22204b400fecd4
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/67ecf3a21608e20449bcb7895b22204b400fecd4
6
reference_url https://github.com/apache/struts/commit/9260720568cee9e868d2899228eceed0c3359323
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/9260720568cee9e868d2899228eceed0c3359323
7
reference_url https://lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3@%3Cissues.struts.apache.org%3E
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3@%3Cissues.struts.apache.org%3E
8
reference_url https://lists.apache.org/thread.html/rf482c101a88445d73cc2e89dbf7f16ae00a4aa79a544a1e72b2326db@%3Cissues.struts.apache.org%3E
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/rf482c101a88445d73cc2e89dbf7f16ae00a4aa79a544a1e72b2326db@%3Cissues.struts.apache.org%3E
9
reference_url https://security.netapp.com/advisory/ntap-20180330-0001
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20180330-0001
10
reference_url https://security.netapp.com/advisory/ntap-20180330-0001/
reference_id
reference_type
scores
url https://security.netapp.com/advisory/ntap-20180330-0001/
11
reference_url https://struts.apache.org/docs/s2-056.html
reference_id
reference_type
scores
url https://struts.apache.org/docs/s2-056.html
12
reference_url https://web.archive.org/web/20200227124859/http://www.securityfocus.com/bid/103516
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200227124859/http://www.securityfocus.com/bid/103516
13
reference_url https://web.archive.org/web/20200923124543/http://www.securitytracker.com/id/1040575
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200923124543/http://www.securitytracker.com/id/1040575
14
reference_url http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
15
reference_url http://www.securityfocus.com/bid/103516
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/103516
16
reference_url http://www.securitytracker.com/id/1040575
reference_id
reference_type
scores
url http://www.securitytracker.com/id/1040575
17
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1561007
reference_id 1561007
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1561007
18
reference_url https://access.redhat.com/security/cve/CVE-2018-1327
reference_id CVE-2018-1327
reference_type
scores
url https://access.redhat.com/security/cve/CVE-2018-1327
19
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-1327
reference_id CVE-2018-1327
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2018-1327
20
reference_url https://github.com/advisories/GHSA-38cr-2ph5-frr9
reference_id GHSA-38cr-2ph5-frr9
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-38cr-2ph5-frr9
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.5.16
purl pkg:maven/org.apache.struts/struts2-core@2.5.16
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-7hxh-btrk-skhg
2
vulnerability VCID-7uv9-4vy7-ryd1
3
vulnerability VCID-8cmt-z8g9-duf2
4
vulnerability VCID-dbzr-zyeu-73g8
5
vulnerability VCID-gvwn-8r4r-47gm
6
vulnerability VCID-mvdz-exud-3ybz
7
vulnerability VCID-nm42-xrpq-7ued
8
vulnerability VCID-nztp-y8p8-cqc6
9
vulnerability VCID-renj-v5ce-2khx
10
vulnerability VCID-wzez-6cmp-n7gn
11
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5.16
aliases CVE-2018-1327, GHSA-38cr-2ph5-frr9
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dj42-wym9-nbhv
17
url VCID-dvxu-9sh6-qbef
vulnerability_id VCID-dvxu-9sh6-qbef
summary 
Improper Input Validation
Using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-12611.json
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-12611.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-12611
reference_id
reference_type
scores
0
value 0.94228
scoring_system epss
scoring_elements 0.9993
published_at 2026-06-05T12:55:00Z
1
value 0.94228
scoring_system epss
scoring_elements 0.99929
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-12611
2
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
3
reference_url https://github.com/apache/struts/commit/2306f5f7fad7f0157f216f34331238feb0539fa
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/2306f5f7fad7f0157f216f34331238feb0539fa
4
reference_url https://github.com/apache/struts/commit/637ad1c3707266c33daabb18d7754e795e6681f
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/637ad1c3707266c33daabb18d7754e795e6681f
5
reference_url https://kb.netapp.com/support/s/article/ka51A000000CgttQAC/NTAP-20170911-0001
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://kb.netapp.com/support/s/article/ka51A000000CgttQAC/NTAP-20170911-0001
6
reference_url https://struts.apache.org/docs/s2-053.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://struts.apache.org/docs/s2-053.html
7
reference_url https://web.archive.org/web/20170923161654/http://www.securityfocus.com/bid/100829
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20170923161654/http://www.securityfocus.com/bid/100829
8
reference_url http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt
9
reference_url http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
10
reference_url http://www.securityfocus.com/bid/100829
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/100829
11
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1489478
reference_id 1489478
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1489478
12
reference_url https://github.com/brianwrf/S2-053-CVE-2017-12611/blob/a587bbdc79843fe44ad3fe0439d7add3f887bc31/exploit.py
reference_id CVE-2017-12611
reference_type exploit
scores
url https://github.com/brianwrf/S2-053-CVE-2017-12611/blob/a587bbdc79843fe44ad3fe0439d7add3f887bc31/exploit.py
13
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/44556.py
reference_id CVE-2017-12611
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/44556.py
14
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-12611
reference_id CVE-2017-12611
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2017-12611
15
reference_url https://github.com/advisories/GHSA-8fx9-5hx8-crhm
reference_id GHSA-8fx9-5hx8-crhm
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-8fx9-5hx8-crhm
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.20.3
purl pkg:maven/org.apache.struts/struts2-core@2.3.20.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-4bzw-ges2-d7ek
2
vulnerability VCID-7hxh-btrk-skhg
3
vulnerability VCID-7uv9-4vy7-ryd1
4
vulnerability VCID-8cmt-z8g9-duf2
5
vulnerability VCID-9mn7-d2mm-uqay
6
vulnerability VCID-cv6j-98vx-n3ed
7
vulnerability VCID-dbzr-zyeu-73g8
8
vulnerability VCID-dj42-wym9-nbhv
9
vulnerability VCID-fwkj-x53j-yqd8
10
vulnerability VCID-gvwn-8r4r-47gm
11
vulnerability VCID-jzbz-jpe1-cycg
12
vulnerability VCID-mmth-7rgf-aqfa
13
vulnerability VCID-mvdz-exud-3ybz
14
vulnerability VCID-nm42-xrpq-7ued
15
vulnerability VCID-npge-yn8z-6fac
16
vulnerability VCID-nztp-y8p8-cqc6
17
vulnerability VCID-pdny-erzd-jqhc
18
vulnerability VCID-q2ad-khtm-nqdr
19
vulnerability VCID-qdsq-8td3-5qa1
20
vulnerability VCID-renj-v5ce-2khx
21
vulnerability VCID-vztu-pap6-37ev
22
vulnerability VCID-wzez-6cmp-n7gn
23
vulnerability VCID-xgnf-d44x-kfc9
24
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.20.3
1
url pkg:maven/org.apache.struts/struts2-core@2.3.34
purl pkg:maven/org.apache.struts/struts2-core@2.3.34
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-7hxh-btrk-skhg
2
vulnerability VCID-7uv9-4vy7-ryd1
3
vulnerability VCID-8cmt-z8g9-duf2
4
vulnerability VCID-dbzr-zyeu-73g8
5
vulnerability VCID-dj42-wym9-nbhv
6
vulnerability VCID-gvwn-8r4r-47gm
7
vulnerability VCID-mvdz-exud-3ybz
8
vulnerability VCID-nm42-xrpq-7ued
9
vulnerability VCID-nztp-y8p8-cqc6
10
vulnerability VCID-renj-v5ce-2khx
11
vulnerability VCID-wzez-6cmp-n7gn
12
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.34
2
url pkg:maven/org.apache.struts/struts2-core@2.5.10.1
purl pkg:maven/org.apache.struts/struts2-core@2.5.10.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-21k4-5a8r-7bd9
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-7hxh-btrk-skhg
3
vulnerability VCID-7uv9-4vy7-ryd1
4
vulnerability VCID-8cmt-z8g9-duf2
5
vulnerability VCID-dbzr-zyeu-73g8
6
vulnerability VCID-dj42-wym9-nbhv
7
vulnerability VCID-dvxu-9sh6-qbef
8
vulnerability VCID-gvwn-8r4r-47gm
9
vulnerability VCID-hrky-nmnv-g3eu
10
vulnerability VCID-mmth-7rgf-aqfa
11
vulnerability VCID-mvdz-exud-3ybz
12
vulnerability VCID-nm42-xrpq-7ued
13
vulnerability VCID-nztp-y8p8-cqc6
14
vulnerability VCID-renj-v5ce-2khx
15
vulnerability VCID-wzez-6cmp-n7gn
16
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5.10.1
3
url pkg:maven/org.apache.struts/struts2-core@2.5.11
purl pkg:maven/org.apache.struts/struts2-core@2.5.11
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5.11
4
url pkg:maven/org.apache.struts/struts2-core@2.5.12
purl pkg:maven/org.apache.struts/struts2-core@2.5.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-7hxh-btrk-skhg
2
vulnerability VCID-7uv9-4vy7-ryd1
3
vulnerability VCID-8cmt-z8g9-duf2
4
vulnerability VCID-dbzr-zyeu-73g8
5
vulnerability VCID-dj42-wym9-nbhv
6
vulnerability VCID-gvwn-8r4r-47gm
7
vulnerability VCID-hrky-nmnv-g3eu
8
vulnerability VCID-mvdz-exud-3ybz
9
vulnerability VCID-nm42-xrpq-7ued
10
vulnerability VCID-nztp-y8p8-cqc6
11
vulnerability VCID-renj-v5ce-2khx
12
vulnerability VCID-wzez-6cmp-n7gn
13
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5.12
aliases CVE-2017-12611, GHSA-8fx9-5hx8-crhm
risk_score 10.0
exploitability 2.0
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dvxu-9sh6-qbef
18
url VCID-fvde-37ch-z7cg
vulnerability_id VCID-fvde-37ch-z7cg
summary 
XSS via malicious action parameter
Multiple cross-site scripting (XSS) vulnerabilities in this package allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to `actionNames.action` and `showConfig.action` in `config-browser/`.
references
0
reference_url http://packetstormsecurity.com/files/123805/Struts-2.3.15.3-Cross-Site-Scripting.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://packetstormsecurity.com/files/123805/Struts-2.3.15.3-Cross-Site-Scripting.html
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-6348
reference_id
reference_type
scores
0
value 0.02766
scoring_system epss
scoring_elements 0.86322
published_at 2026-06-05T12:55:00Z
1
value 0.02766
scoring_system epss
scoring_elements 0.86301
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-6348
2
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6348
reference_id
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6348
3
reference_url http://seclists.org/fulldisclosure/2013/Oct/244
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://seclists.org/fulldisclosure/2013/Oct/244
4
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
5
reference_url https://issues.apache.org/jira/browse/WW-4213
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://issues.apache.org/jira/browse/WW-4213
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-6348
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-6348
7
reference_url https://security-tracker.debian.org/tracker/CVE-2013-6348
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://security-tracker.debian.org/tracker/CVE-2013-6348
8
reference_url https://svn.apache.org/viewvc?view=revision&revision=1533354
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://svn.apache.org/viewvc?view=revision&revision=1533354
9
reference_url https://ubuntu.com/security/CVE-2013-6348
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://ubuntu.com/security/CVE-2013-6348
10
reference_url https://github.com/advisories/GHSA-3g8j-jj54-3vjg
reference_id GHSA-3g8j-jj54-3vjg
reference_type
scores
url https://github.com/advisories/GHSA-3g8j-jj54-3vjg
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.16
purl pkg:maven/org.apache.struts/struts2-core@2.3.16
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1uv2-rvmy-53hk
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-4bzw-ges2-d7ek
3
vulnerability VCID-4ywn-n1my-83ev
4
vulnerability VCID-7hxh-btrk-skhg
5
vulnerability VCID-7uv9-4vy7-ryd1
6
vulnerability VCID-84ge-vq7u-j3ar
7
vulnerability VCID-8cmt-z8g9-duf2
8
vulnerability VCID-8jup-umjw-9ba4
9
vulnerability VCID-9mn7-d2mm-uqay
10
vulnerability VCID-cv6j-98vx-n3ed
11
vulnerability VCID-dbzr-zyeu-73g8
12
vulnerability VCID-dj42-wym9-nbhv
13
vulnerability VCID-dvxu-9sh6-qbef
14
vulnerability VCID-fwkj-x53j-yqd8
15
vulnerability VCID-ghqg-ae1b-w7br
16
vulnerability VCID-gvwn-8r4r-47gm
17
vulnerability VCID-hrky-nmnv-g3eu
18
vulnerability VCID-jzbz-jpe1-cycg
19
vulnerability VCID-m39c-3bv2-6ugy
20
vulnerability VCID-mmth-7rgf-aqfa
21
vulnerability VCID-mvdz-exud-3ybz
22
vulnerability VCID-nm42-xrpq-7ued
23
vulnerability VCID-npge-yn8z-6fac
24
vulnerability VCID-nztp-y8p8-cqc6
25
vulnerability VCID-pdny-erzd-jqhc
26
vulnerability VCID-q2ad-khtm-nqdr
27
vulnerability VCID-renj-v5ce-2khx
28
vulnerability VCID-t1s3-f181-tqca
29
vulnerability VCID-vztu-pap6-37ev
30
vulnerability VCID-wtca-5ffw-w7bc
31
vulnerability VCID-wzez-6cmp-n7gn
32
vulnerability VCID-xgnf-d44x-kfc9
33
vulnerability VCID-z1jy-4da2-tyhk
34
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.16
aliases CVE-2013-6348, GHSA-3g8j-jj54-3vjg
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-fvde-37ch-z7cg
19
url VCID-fwkj-x53j-yqd8
vulnerability_id VCID-fwkj-x53j-yqd8
summary 
Manipulation of Struts internals
This package allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2015-5209
reference_id
reference_type
scores
0
value 0.01362
scoring_system epss
scoring_elements 0.80507
published_at 2026-06-04T12:55:00Z
1
value 0.01362
scoring_system epss
scoring_elements 0.80533
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2015-5209
1
reference_url https://nvd.nist.gov/vuln/detail/CVE-2015-5209
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2015-5209
2
reference_url https://security.netapp.com/advisory/ntap-20180629-0002
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20180629-0002
3
reference_url https://struts.apache.org/docs/s2-026.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://struts.apache.org/docs/s2-026.html
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.24.1
purl pkg:maven/org.apache.struts/struts2-core@2.3.24.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1cxn-qv1w-2kh7
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-4bzw-ges2-d7ek
3
vulnerability VCID-6dfe-8yy4-kkfj
4
vulnerability VCID-7hxh-btrk-skhg
5
vulnerability VCID-7uv9-4vy7-ryd1
6
vulnerability VCID-8cmt-z8g9-duf2
7
vulnerability VCID-9mn7-d2mm-uqay
8
vulnerability VCID-cv6j-98vx-n3ed
9
vulnerability VCID-dbzr-zyeu-73g8
10
vulnerability VCID-dj42-wym9-nbhv
11
vulnerability VCID-gvwn-8r4r-47gm
12
vulnerability VCID-jzbz-jpe1-cycg
13
vulnerability VCID-mmth-7rgf-aqfa
14
vulnerability VCID-mvdz-exud-3ybz
15
vulnerability VCID-nm42-xrpq-7ued
16
vulnerability VCID-npge-yn8z-6fac
17
vulnerability VCID-nztp-y8p8-cqc6
18
vulnerability VCID-pdny-erzd-jqhc
19
vulnerability VCID-q2ad-khtm-nqdr
20
vulnerability VCID-qdsq-8td3-5qa1
21
vulnerability VCID-renj-v5ce-2khx
22
vulnerability VCID-vztu-pap6-37ev
23
vulnerability VCID-wzez-6cmp-n7gn
24
vulnerability VCID-xgnf-d44x-kfc9
25
vulnerability VCID-z1jy-4da2-tyhk
26
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.24.1
aliases CVE-2015-5209, GHSA-4qgj-9mvg-3929
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-fwkj-x53j-yqd8
20
url VCID-ghqg-ae1b-w7br
vulnerability_id VCID-ghqg-ae1b-w7br
summary 
Classloader manipulation via CookieInterceptor
CookieInterceptor in this package, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0116.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0116.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2014-0116
reference_id
reference_type
scores
0
value 0.02831
scoring_system epss
scoring_elements 0.86473
published_at 2026-06-05T12:55:00Z
1
value 0.02831
scoring_system epss
scoring_elements 0.8645
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2014-0116
2
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
3
reference_url https://github.com/apache/struts/commit/1a668af7f1ffccea4a3b46d8d8c1fe1c7331ff02
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/1a668af7f1ffccea4a3b46d8d8c1fe1c7331ff02
4
reference_url https://github.com/apache/struts/commit/74e26830d2849a84729b33497f729e0f033dc147
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/74e26830d2849a84729b33497f729e0f033dc147
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2014-0116
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2014-0116
6
reference_url http://struts.apache.org/docs/s2-022.html
reference_id
reference_type
scores
url http://struts.apache.org/docs/s2-022.html
7
reference_url http://struts.apache.org/release/2.3.x/docs/s2-022.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://struts.apache.org/release/2.3.x/docs/s2-022.html
8
reference_url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0116
reference_id
reference_type
scores
url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0116
9
reference_url http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
10
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1094558
reference_id 1094558
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1094558
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.16.3
purl pkg:maven/org.apache.struts/struts2-core@2.3.16.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-4bzw-ges2-d7ek
2
vulnerability VCID-4ywn-n1my-83ev
3
vulnerability VCID-7hxh-btrk-skhg
4
vulnerability VCID-7uv9-4vy7-ryd1
5
vulnerability VCID-8cmt-z8g9-duf2
6
vulnerability VCID-9mn7-d2mm-uqay
7
vulnerability VCID-cv6j-98vx-n3ed
8
vulnerability VCID-dbzr-zyeu-73g8
9
vulnerability VCID-dj42-wym9-nbhv
10
vulnerability VCID-dvxu-9sh6-qbef
11
vulnerability VCID-fwkj-x53j-yqd8
12
vulnerability VCID-gvwn-8r4r-47gm
13
vulnerability VCID-hrky-nmnv-g3eu
14
vulnerability VCID-jzbz-jpe1-cycg
15
vulnerability VCID-m39c-3bv2-6ugy
16
vulnerability VCID-mmth-7rgf-aqfa
17
vulnerability VCID-mvdz-exud-3ybz
18
vulnerability VCID-nm42-xrpq-7ued
19
vulnerability VCID-npge-yn8z-6fac
20
vulnerability VCID-nztp-y8p8-cqc6
21
vulnerability VCID-pdny-erzd-jqhc
22
vulnerability VCID-q2ad-khtm-nqdr
23
vulnerability VCID-renj-v5ce-2khx
24
vulnerability VCID-t1s3-f181-tqca
25
vulnerability VCID-vztu-pap6-37ev
26
vulnerability VCID-wtca-5ffw-w7bc
27
vulnerability VCID-wzez-6cmp-n7gn
28
vulnerability VCID-xgnf-d44x-kfc9
29
vulnerability VCID-z1jy-4da2-tyhk
30
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.16.3
1
url pkg:maven/org.apache.struts/struts2-core@2.3.20
purl pkg:maven/org.apache.struts/struts2-core@2.3.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1cxn-qv1w-2kh7
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-4bzw-ges2-d7ek
3
vulnerability VCID-4t8h-s9mh-p7c4
4
vulnerability VCID-6dfe-8yy4-kkfj
5
vulnerability VCID-7hxh-btrk-skhg
6
vulnerability VCID-7uv9-4vy7-ryd1
7
vulnerability VCID-8cmt-z8g9-duf2
8
vulnerability VCID-9mn7-d2mm-uqay
9
vulnerability VCID-cv6j-98vx-n3ed
10
vulnerability VCID-dbzr-zyeu-73g8
11
vulnerability VCID-dj42-wym9-nbhv
12
vulnerability VCID-dvxu-9sh6-qbef
13
vulnerability VCID-fwkj-x53j-yqd8
14
vulnerability VCID-gvwn-8r4r-47gm
15
vulnerability VCID-hrky-nmnv-g3eu
16
vulnerability VCID-jzbz-jpe1-cycg
17
vulnerability VCID-mmth-7rgf-aqfa
18
vulnerability VCID-mvdz-exud-3ybz
19
vulnerability VCID-nm42-xrpq-7ued
20
vulnerability VCID-npge-yn8z-6fac
21
vulnerability VCID-nztp-y8p8-cqc6
22
vulnerability VCID-pdny-erzd-jqhc
23
vulnerability VCID-q2ad-khtm-nqdr
24
vulnerability VCID-qdsq-8td3-5qa1
25
vulnerability VCID-renj-v5ce-2khx
26
vulnerability VCID-vztu-pap6-37ev
27
vulnerability VCID-wzez-6cmp-n7gn
28
vulnerability VCID-xgnf-d44x-kfc9
29
vulnerability VCID-z1jy-4da2-tyhk
30
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.20
aliases CVE-2014-0116, GHSA-hmhq-382q-mp56
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ghqg-ae1b-w7br
21
url VCID-gvwn-8r4r-47gm
vulnerability_id VCID-gvwn-8r4r-47gm
summary 
Apache Struts has a Denial of Service vulnerability
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.

This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.

Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-66675
reference_id
reference_type
scores
0
value 0.00201
scoring_system epss
scoring_elements 0.42166
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-66675
1
reference_url https://cve.org/CVERecord?id=CVE-2025-64775
reference_id
reference_type
scores
0
value 8.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-10T14:52:50Z/
url https://cve.org/CVERecord?id=CVE-2025-64775
2
reference_url https://cwiki.apache.org/confluence/display/WW/S2-068
reference_id
reference_type
scores
0
value 8.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-10T14:52:50Z/
url https://cwiki.apache.org/confluence/display/WW/S2-068
3
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 8.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
4
reference_url https://github.com/apache/struts/commit/831568929cfba700f790f6ebe6e335f9f33fb468
reference_id
reference_type
scores
0
value 8.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/831568929cfba700f790f6ebe6e335f9f33fb468
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-66675
reference_id CVE-2025-66675
reference_type
scores
0
value 8.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-66675
6
reference_url https://github.com/advisories/GHSA-rg58-xhh7-mqjw
reference_id GHSA-rg58-xhh7-mqjw
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-rg58-xhh7-mqjw
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@6.8.0
purl pkg:maven/org.apache.struts/struts2-core@6.8.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@6.8.0
1
url pkg:maven/org.apache.struts/struts2-core@7.1.1
purl pkg:maven/org.apache.struts/struts2-core@7.1.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@7.1.1
aliases CVE-2025-66675, GHSA-rg58-xhh7-mqjw
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-gvwn-8r4r-47gm
22
url VCID-hrky-nmnv-g3eu
vulnerability_id VCID-hrky-nmnv-g3eu
summary 
Improper Input Validation
If an application allows entering a URL in a form field and built-in `URLValidator` is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-9804.json
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-9804.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-9804
reference_id
reference_type
scores
0
value 0.04618
scoring_system epss
scoring_elements 0.89468
published_at 2026-06-05T12:55:00Z
1
value 0.04618
scoring_system epss
scoring_elements 0.89449
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-9804
2
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
3
reference_url https://github.com/apache/struts/commit/3fddfb6eb562d597c935084e9e81d43ed6bcd02
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/3fddfb6eb562d597c935084e9e81d43ed6bcd02
4
reference_url https://github.com/apache/struts/commit/418a20c0594f23764fe29ced400c1219239899a
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/418a20c0594f23764fe29ced400c1219239899a
5
reference_url https://github.com/apache/struts/commit/744c1f409d983641af3e8e3b573c2f2d2c2c6d9
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/744c1f409d983641af3e8e3b573c2f2d2c2c6d9
6
reference_url https://github.com/apache/struts/commit/8a04e80f01350c90f053d71366d5e0c2186fded
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/8a04e80f01350c90f053d71366d5e0c2186fded
7
reference_url https://github.com/apache/struts/commit/9d47af6ffa355977b5acc713e6d1f25fac260a2
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/9d47af6ffa355977b5acc713e6d1f25fac260a2
8
reference_url https://github.com/apache/struts/commit/a05259ed69a5a48379aa91650e4cd1cb4bd6e5a
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/a05259ed69a5a48379aa91650e4cd1cb4bd6e5a
9
reference_url https://security.netapp.com/advisory/ntap-20180629-0001
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20180629-0001
10
reference_url https://security.netapp.com/advisory/ntap-20180629-0001/
reference_id
reference_type
scores
url https://security.netapp.com/advisory/ntap-20180629-0001/
11
reference_url https://struts.apache.org/docs/s2-050.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://struts.apache.org/docs/s2-050.html
12
reference_url https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2
13
reference_url https://web.archive.org/web/20171113165852/http://www.securityfocus.com/bid/100612
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20171113165852/http://www.securityfocus.com/bid/100612
14
reference_url https://web.archive.org/web/20201021075553/http://www.securitytracker.com/id/1039261
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20201021075553/http://www.securitytracker.com/id/1039261
15
reference_url http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt
16
reference_url http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
17
reference_url http://www.securityfocus.com/bid/100612
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/100612
18
reference_url http://www.securitytracker.com/id/1039261
reference_id
reference_type
scores
url http://www.securitytracker.com/id/1039261
19
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1488491
reference_id 1488491
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1488491
20
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-9804
reference_id CVE-2017-9804
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2017-9804
21
reference_url https://github.com/advisories/GHSA-x5x7-3v85-wpc4
reference_id GHSA-x5x7-3v85-wpc4
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-x5x7-3v85-wpc4
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.20.3
purl pkg:maven/org.apache.struts/struts2-core@2.3.20.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-4bzw-ges2-d7ek
2
vulnerability VCID-7hxh-btrk-skhg
3
vulnerability VCID-7uv9-4vy7-ryd1
4
vulnerability VCID-8cmt-z8g9-duf2
5
vulnerability VCID-9mn7-d2mm-uqay
6
vulnerability VCID-cv6j-98vx-n3ed
7
vulnerability VCID-dbzr-zyeu-73g8
8
vulnerability VCID-dj42-wym9-nbhv
9
vulnerability VCID-fwkj-x53j-yqd8
10
vulnerability VCID-gvwn-8r4r-47gm
11
vulnerability VCID-jzbz-jpe1-cycg
12
vulnerability VCID-mmth-7rgf-aqfa
13
vulnerability VCID-mvdz-exud-3ybz
14
vulnerability VCID-nm42-xrpq-7ued
15
vulnerability VCID-npge-yn8z-6fac
16
vulnerability VCID-nztp-y8p8-cqc6
17
vulnerability VCID-pdny-erzd-jqhc
18
vulnerability VCID-q2ad-khtm-nqdr
19
vulnerability VCID-qdsq-8td3-5qa1
20
vulnerability VCID-renj-v5ce-2khx
21
vulnerability VCID-vztu-pap6-37ev
22
vulnerability VCID-wzez-6cmp-n7gn
23
vulnerability VCID-xgnf-d44x-kfc9
24
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.20.3
1
url pkg:maven/org.apache.struts/struts2-core@2.3.24
purl pkg:maven/org.apache.struts/struts2-core@2.3.24
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1cxn-qv1w-2kh7
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-4bzw-ges2-d7ek
3
vulnerability VCID-6dfe-8yy4-kkfj
4
vulnerability VCID-7hxh-btrk-skhg
5
vulnerability VCID-7uv9-4vy7-ryd1
6
vulnerability VCID-8cmt-z8g9-duf2
7
vulnerability VCID-9mn7-d2mm-uqay
8
vulnerability VCID-cv6j-98vx-n3ed
9
vulnerability VCID-dbzr-zyeu-73g8
10
vulnerability VCID-dj42-wym9-nbhv
11
vulnerability VCID-fwkj-x53j-yqd8
12
vulnerability VCID-gvwn-8r4r-47gm
13
vulnerability VCID-jzbz-jpe1-cycg
14
vulnerability VCID-mmth-7rgf-aqfa
15
vulnerability VCID-mvdz-exud-3ybz
16
vulnerability VCID-nm42-xrpq-7ued
17
vulnerability VCID-npge-yn8z-6fac
18
vulnerability VCID-nztp-y8p8-cqc6
19
vulnerability VCID-pdny-erzd-jqhc
20
vulnerability VCID-q2ad-khtm-nqdr
21
vulnerability VCID-qdsq-8td3-5qa1
22
vulnerability VCID-renj-v5ce-2khx
23
vulnerability VCID-vztu-pap6-37ev
24
vulnerability VCID-wzez-6cmp-n7gn
25
vulnerability VCID-xgnf-d44x-kfc9
26
vulnerability VCID-z1jy-4da2-tyhk
27
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.24
2
url pkg:maven/org.apache.struts/struts2-core@2.3.34
purl pkg:maven/org.apache.struts/struts2-core@2.3.34
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-7hxh-btrk-skhg
2
vulnerability VCID-7uv9-4vy7-ryd1
3
vulnerability VCID-8cmt-z8g9-duf2
4
vulnerability VCID-dbzr-zyeu-73g8
5
vulnerability VCID-dj42-wym9-nbhv
6
vulnerability VCID-gvwn-8r4r-47gm
7
vulnerability VCID-mvdz-exud-3ybz
8
vulnerability VCID-nm42-xrpq-7ued
9
vulnerability VCID-nztp-y8p8-cqc6
10
vulnerability VCID-renj-v5ce-2khx
11
vulnerability VCID-wzez-6cmp-n7gn
12
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.34
3
url pkg:maven/org.apache.struts/struts2-core@2.5.13
purl pkg:maven/org.apache.struts/struts2-core@2.5.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-7hxh-btrk-skhg
2
vulnerability VCID-7uv9-4vy7-ryd1
3
vulnerability VCID-8cmt-z8g9-duf2
4
vulnerability VCID-dbzr-zyeu-73g8
5
vulnerability VCID-dj42-wym9-nbhv
6
vulnerability VCID-gvwn-8r4r-47gm
7
vulnerability VCID-mvdz-exud-3ybz
8
vulnerability VCID-nm42-xrpq-7ued
9
vulnerability VCID-nztp-y8p8-cqc6
10
vulnerability VCID-renj-v5ce-2khx
11
vulnerability VCID-wzez-6cmp-n7gn
12
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5.13
aliases CVE-2017-9804, GHSA-x5x7-3v85-wpc4
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-hrky-nmnv-g3eu
23
url VCID-jzbz-jpe1-cycg
vulnerability_id VCID-jzbz-jpe1-cycg
summary 
Apache Struts improper action name cleanup
Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-4436.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-4436.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-4436
reference_id
reference_type
scores
0
value 0.05743
scoring_system epss
scoring_elements 0.90609
published_at 2026-06-04T12:55:00Z
1
value 0.05743
scoring_system epss
scoring_elements 0.90623
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-4436
2
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
3
reference_url https://github.com/apache/struts/commit/237432512df0e27013f7c7b9ab59fdce44ca34a5
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/237432512df0e27013f7c7b9ab59fdce44ca34a5
4
reference_url https://github.com/apache/struts/commit/27ca165ddbf81c84bafbd083b99a18d89cc49ca7
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/27ca165ddbf81c84bafbd083b99a18d89cc49ca7
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-4436
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-4436
6
reference_url https://struts.apache.org/docs/s2-035.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://struts.apache.org/docs/s2-035.html
7
reference_url https://web.archive.org/web/20161015140316/http://www.securityfocus.com/bid/91280
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20161015140316/http://www.securityfocus.com/bid/91280
8
reference_url https://web.archive.org/web/20161015140316/http://www.securityfocus.com/bid/91280/
reference_id
reference_type
scores
url https://web.archive.org/web/20161015140316/http://www.securityfocus.com/bid/91280/
9
reference_url http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009282
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009282
10
reference_url http://www-01.ibm.com/support/docview.wss?uid=swg21987854
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url http://www-01.ibm.com/support/docview.wss?uid=swg21987854
11
reference_url http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
12
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1348233
reference_id 1348233
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1348233
13
reference_url https://github.com/advisories/GHSA-xm92-v2mq-842q
reference_id GHSA-xm92-v2mq-842q
reference_type
scores
url https://github.com/advisories/GHSA-xm92-v2mq-842q
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.29
purl pkg:maven/org.apache.struts/struts2-core@2.3.29
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-7hxh-btrk-skhg
2
vulnerability VCID-7uv9-4vy7-ryd1
3
vulnerability VCID-8cmt-z8g9-duf2
4
vulnerability VCID-cv6j-98vx-n3ed
5
vulnerability VCID-dbzr-zyeu-73g8
6
vulnerability VCID-dj42-wym9-nbhv
7
vulnerability VCID-dvxu-9sh6-qbef
8
vulnerability VCID-gvwn-8r4r-47gm
9
vulnerability VCID-hrky-nmnv-g3eu
10
vulnerability VCID-mmth-7rgf-aqfa
11
vulnerability VCID-mvdz-exud-3ybz
12
vulnerability VCID-nm42-xrpq-7ued
13
vulnerability VCID-nztp-y8p8-cqc6
14
vulnerability VCID-renj-v5ce-2khx
15
vulnerability VCID-vztu-pap6-37ev
16
vulnerability VCID-wzez-6cmp-n7gn
17
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.29
1
url pkg:maven/org.apache.struts/struts2-core@2.5.1
purl pkg:maven/org.apache.struts/struts2-core@2.5.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-21k4-5a8r-7bd9
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-7hxh-btrk-skhg
3
vulnerability VCID-7uv9-4vy7-ryd1
4
vulnerability VCID-8cmt-z8g9-duf2
5
vulnerability VCID-cv6j-98vx-n3ed
6
vulnerability VCID-dbzr-zyeu-73g8
7
vulnerability VCID-dj42-wym9-nbhv
8
vulnerability VCID-dvxu-9sh6-qbef
9
vulnerability VCID-gvwn-8r4r-47gm
10
vulnerability VCID-hrky-nmnv-g3eu
11
vulnerability VCID-mmth-7rgf-aqfa
12
vulnerability VCID-mvdz-exud-3ybz
13
vulnerability VCID-nm42-xrpq-7ued
14
vulnerability VCID-nztp-y8p8-cqc6
15
vulnerability VCID-renj-v5ce-2khx
16
vulnerability VCID-vztu-pap6-37ev
17
vulnerability VCID-wzez-6cmp-n7gn
18
vulnerability VCID-ybuw-727z-r3eb
19
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5.1
aliases CVE-2016-4436, GHSA-xm92-v2mq-842q
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jzbz-jpe1-cycg
24
url VCID-kmqa-hsqy-muf1
vulnerability_id VCID-kmqa-hsqy-muf1
summary 
Broken Access Control Vulnerability
This package allows remote attackers to bypass access controls via a crafted action: `prefix`.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-4310.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-4310.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-4310
reference_id
reference_type
scores
0
value 0.08725
scoring_system epss
scoring_elements 0.92641
published_at 2026-06-04T12:55:00Z
1
value 0.08725
scoring_system epss
scoring_elements 0.92653
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-4310
2
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
3
reference_url https://github.com/apache/struts/commit/0c8366cb792227d484b9ca13e537037dd0cb57dc
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/0c8366cb792227d484b9ca13e537037dd0cb57dc
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-4310
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-4310
5
reference_url http://struts.apache.org/docs/s2-018.html
reference_id
reference_type
scores
url http://struts.apache.org/docs/s2-018.html
6
reference_url http://struts.apache.org/release/2.3.x/docs/s2-018.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://struts.apache.org/release/2.3.x/docs/s2-018.html
7
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1013030
reference_id 1013030
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1013030
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.15.3
purl pkg:maven/org.apache.struts/struts2-core@2.3.15.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1uv2-rvmy-53hk
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-4bzw-ges2-d7ek
3
vulnerability VCID-4ywn-n1my-83ev
4
vulnerability VCID-7hxh-btrk-skhg
5
vulnerability VCID-7uv9-4vy7-ryd1
6
vulnerability VCID-84ge-vq7u-j3ar
7
vulnerability VCID-8cmt-z8g9-duf2
8
vulnerability VCID-8jup-umjw-9ba4
9
vulnerability VCID-9mn7-d2mm-uqay
10
vulnerability VCID-cv6j-98vx-n3ed
11
vulnerability VCID-dbzr-zyeu-73g8
12
vulnerability VCID-dj42-wym9-nbhv
13
vulnerability VCID-dvxu-9sh6-qbef
14
vulnerability VCID-fvde-37ch-z7cg
15
vulnerability VCID-fwkj-x53j-yqd8
16
vulnerability VCID-ghqg-ae1b-w7br
17
vulnerability VCID-gvwn-8r4r-47gm
18
vulnerability VCID-hrky-nmnv-g3eu
19
vulnerability VCID-jzbz-jpe1-cycg
20
vulnerability VCID-m39c-3bv2-6ugy
21
vulnerability VCID-mmth-7rgf-aqfa
22
vulnerability VCID-mvdz-exud-3ybz
23
vulnerability VCID-nm42-xrpq-7ued
24
vulnerability VCID-npge-yn8z-6fac
25
vulnerability VCID-nztp-y8p8-cqc6
26
vulnerability VCID-pdny-erzd-jqhc
27
vulnerability VCID-q2ad-khtm-nqdr
28
vulnerability VCID-renj-v5ce-2khx
29
vulnerability VCID-t1s3-f181-tqca
30
vulnerability VCID-vztu-pap6-37ev
31
vulnerability VCID-wtca-5ffw-w7bc
32
vulnerability VCID-wzez-6cmp-n7gn
33
vulnerability VCID-xgnf-d44x-kfc9
34
vulnerability VCID-z1jy-4da2-tyhk
35
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.15.3
aliases CVE-2013-4310, GHSA-q5q8-jghf-3pm3
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-kmqa-hsqy-muf1
25
url VCID-m39c-3bv2-6ugy
vulnerability_id VCID-m39c-3bv2-6ugy
summary 
Cross-Site Scripting vulnerability on "Problem Report" screen
When Debug mode is turned on, under certain conditions an arbitrary script may be executed in the `Problem Report` screen. Also if JSP files are exposed to be accessed directly it's possible to execute an arbitrary script.
references
0
reference_url http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000125.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000125.html
1
reference_url http://jvn.jp/en/jp/JVN95989300/index.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://jvn.jp/en/jp/JVN95989300/index.html
2
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5169.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5169.json
3
reference_url https://api.first.org/data/v1/epss?cve=CVE-2015-5169
reference_id
reference_type
scores
0
value 0.01198
scoring_system epss
scoring_elements 0.79222
published_at 2026-06-04T12:55:00Z
1
value 0.01198
scoring_system epss
scoring_elements 0.79248
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2015-5169
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1260087
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=1260087
5
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2015-5169
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2015-5169
7
reference_url https://security.netapp.com/advisory/ntap-20180629-0003
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20180629-0003
8
reference_url https://struts.apache.org/docs/s2-025.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://struts.apache.org/docs/s2-025.html
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.20
purl pkg:maven/org.apache.struts/struts2-core@2.3.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1cxn-qv1w-2kh7
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-4bzw-ges2-d7ek
3
vulnerability VCID-4t8h-s9mh-p7c4
4
vulnerability VCID-6dfe-8yy4-kkfj
5
vulnerability VCID-7hxh-btrk-skhg
6
vulnerability VCID-7uv9-4vy7-ryd1
7
vulnerability VCID-8cmt-z8g9-duf2
8
vulnerability VCID-9mn7-d2mm-uqay
9
vulnerability VCID-cv6j-98vx-n3ed
10
vulnerability VCID-dbzr-zyeu-73g8
11
vulnerability VCID-dj42-wym9-nbhv
12
vulnerability VCID-dvxu-9sh6-qbef
13
vulnerability VCID-fwkj-x53j-yqd8
14
vulnerability VCID-gvwn-8r4r-47gm
15
vulnerability VCID-hrky-nmnv-g3eu
16
vulnerability VCID-jzbz-jpe1-cycg
17
vulnerability VCID-mmth-7rgf-aqfa
18
vulnerability VCID-mvdz-exud-3ybz
19
vulnerability VCID-nm42-xrpq-7ued
20
vulnerability VCID-npge-yn8z-6fac
21
vulnerability VCID-nztp-y8p8-cqc6
22
vulnerability VCID-pdny-erzd-jqhc
23
vulnerability VCID-q2ad-khtm-nqdr
24
vulnerability VCID-qdsq-8td3-5qa1
25
vulnerability VCID-renj-v5ce-2khx
26
vulnerability VCID-vztu-pap6-37ev
27
vulnerability VCID-wzez-6cmp-n7gn
28
vulnerability VCID-xgnf-d44x-kfc9
29
vulnerability VCID-z1jy-4da2-tyhk
30
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.20
aliases CVE-2015-5169, GHSA-vwhv-j36g-5rm8
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-m39c-3bv2-6ugy
26
url VCID-mmth-7rgf-aqfa
vulnerability_id VCID-mmth-7rgf-aqfa
summary 
Uncontrolled Resource Consumption
When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-9787.json
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-9787.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-9787
reference_id
reference_type
scores
0
value 0.08229
scoring_system epss
scoring_elements 0.92377
published_at 2026-06-05T12:55:00Z
1
value 0.08229
scoring_system epss
scoring_elements 0.92363
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-9787
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:S/C:N/I:N/A:P
1
value 4.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/apache/struts/commit/086b63735527d4bb0c1dd0d86a7c0374b825ff2
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/086b63735527d4bb0c1dd0d86a7c0374b825ff2
4
reference_url https://github.com/apache/struts/commit/0d6442bab5b44d93c4c2e63c5335f0a331333b9
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/0d6442bab5b44d93c4c2e63c5335f0a331333b9
5
reference_url https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d@%3Cannouncements.struts.apache.org%3E
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d@%3Cannouncements.struts.apache.org%3E
6
reference_url https://lists.apache.org/thread.html/de3d325f0433cd3b42258b6a302c0d7a72b69eedc1480ed561d3b065@%3Cannouncements.struts.apache.org%3E
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/de3d325f0433cd3b42258b6a302c0d7a72b69eedc1480ed561d3b065@%3Cannouncements.struts.apache.org%3E
7
reference_url https://security.netapp.com/advisory/ntap-20180706-0002
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20180706-0002
8
reference_url http://struts.apache.org/docs/s2-049.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://struts.apache.org/docs/s2-049.html
9
reference_url https://web.archive.org/web/20170910013819/http://www.securitytracker.com/id/1039115
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20170910013819/http://www.securitytracker.com/id/1039115
10
reference_url https://web.archive.org/web/20200227144723/http://www.securityfocus.com/bid/99562
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20200227144723/http://www.securityfocus.com/bid/99562
11
reference_url http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
12
reference_url http://www.securityfocus.com/bid/99562
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/99562
13
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1480608
reference_id 1480608
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1480608
14
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-9787
reference_id CVE-2017-9787
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2017-9787
15
reference_url https://github.com/advisories/GHSA-8mr5-h28g-36qx
reference_id GHSA-8mr5-h28g-36qx
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-8mr5-h28g-36qx
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.33
purl pkg:maven/org.apache.struts/struts2-core@2.3.33
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-7hxh-btrk-skhg
2
vulnerability VCID-7uv9-4vy7-ryd1
3
vulnerability VCID-8cmt-z8g9-duf2
4
vulnerability VCID-dbzr-zyeu-73g8
5
vulnerability VCID-dj42-wym9-nbhv
6
vulnerability VCID-dvxu-9sh6-qbef
7
vulnerability VCID-gvwn-8r4r-47gm
8
vulnerability VCID-hrky-nmnv-g3eu
9
vulnerability VCID-mvdz-exud-3ybz
10
vulnerability VCID-nm42-xrpq-7ued
11
vulnerability VCID-nztp-y8p8-cqc6
12
vulnerability VCID-renj-v5ce-2khx
13
vulnerability VCID-wzez-6cmp-n7gn
14
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.33
1
url pkg:maven/org.apache.struts/struts2-core@2.5.12
purl pkg:maven/org.apache.struts/struts2-core@2.5.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-7hxh-btrk-skhg
2
vulnerability VCID-7uv9-4vy7-ryd1
3
vulnerability VCID-8cmt-z8g9-duf2
4
vulnerability VCID-dbzr-zyeu-73g8
5
vulnerability VCID-dj42-wym9-nbhv
6
vulnerability VCID-gvwn-8r4r-47gm
7
vulnerability VCID-hrky-nmnv-g3eu
8
vulnerability VCID-mvdz-exud-3ybz
9
vulnerability VCID-nm42-xrpq-7ued
10
vulnerability VCID-nztp-y8p8-cqc6
11
vulnerability VCID-renj-v5ce-2khx
12
vulnerability VCID-wzez-6cmp-n7gn
13
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5.12
aliases CVE-2017-9787, GHSA-8mr5-h28g-36qx
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mmth-7rgf-aqfa
27
url VCID-mvdz-exud-3ybz
vulnerability_id VCID-mvdz-exud-3ybz
summary 
Files or Directories Accessible to External Parties
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
references
0
reference_url http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html
1
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-50164.json
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-50164.json
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-50164
reference_id
reference_type
scores
0
value 0.92896
scoring_system epss
scoring_elements 0.99778
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-50164
3
reference_url https://cwiki.apache.org/confluence/display/WW/S2-066
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://cwiki.apache.org/confluence/display/WW/S2-066
4
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
5
reference_url https://github.com/apache/struts/commit/162e29fee9136f4bfd9b2376da2cbf590f9ea163
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/162e29fee9136f4bfd9b2376da2cbf590f9ea163
6
reference_url https://github.com/apache/struts/commit/d8c69691ef1d15e76a5f4fcf33039316da2340b6
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/d8c69691ef1d15e76a5f4fcf33039316da2340b6
7
reference_url https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj
8
reference_url https://security.netapp.com/advisory/ntap-20231214-0010
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20231214-0010
9
reference_url https://www.openwall.com/lists/oss-security/2023/12/07/1
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.openwall.com/lists/oss-security/2023/12/07/1
10
reference_url http://www.openwall.com/lists/oss-security/2023/12/07/1
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2023/12/07/1
11
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2253938
reference_id 2253938
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2253938
12
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-50164
reference_id CVE-2023-50164
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-50164
13
reference_url https://github.com/advisories/GHSA-2j39-qcjm-428w
reference_id GHSA-2j39-qcjm-428w
reference_type
scores
url https://github.com/advisories/GHSA-2j39-qcjm-428w
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.5.33
purl pkg:maven/org.apache.struts/struts2-core@2.5.33
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-16yc-2abk-1yd2
1
vulnerability VCID-8cmt-z8g9-duf2
2
vulnerability VCID-gvwn-8r4r-47gm
3
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5.33
1
url pkg:maven/org.apache.struts/struts2-core@6.3.0.2
purl pkg:maven/org.apache.struts/struts2-core@6.3.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gvwn-8r4r-47gm
1
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@6.3.0.2
aliases CVE-2023-50164, GHSA-2j39-qcjm-428w
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mvdz-exud-3ybz
28
url VCID-nm42-xrpq-7ued
vulnerability_id VCID-nm42-xrpq-7ued
summary struts2: access permission override when performing a file upload leads to DoS
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-0233.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-0233.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-0233
reference_id
reference_type
scores
0
value 0.0778
scoring_system epss
scoring_elements 0.9212
published_at 2026-06-05T12:55:00Z
1
value 0.0778
scoring_system epss
scoring_elements 0.92108
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-0233
2
reference_url https://cwiki.apache.org/confluence/display/ww/s2-060
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://cwiki.apache.org/confluence/display/ww/s2-060
3
reference_url https://launchpad.support.sap.com/#/notes/2982840
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://launchpad.support.sap.com/#/notes/2982840
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-0233
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-0233
5
reference_url https://www.oracle.com/security-alerts/cpuApr2021.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpuApr2021.html
6
reference_url https://www.oracle.com/security-alerts/cpujan2021.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpujan2021.html
7
reference_url https://www.oracle.com/security-alerts/cpuoct2021.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.oracle.com/security-alerts/cpuoct2021.html
8
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1869682
reference_id 1869682
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1869682
9
reference_url https://github.com/advisories/GHSA-ccp5-gg58-pxfm
reference_id GHSA-ccp5-gg58-pxfm
reference_type
scores
url https://github.com/advisories/GHSA-ccp5-gg58-pxfm
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.5.22
purl pkg:maven/org.apache.struts/struts2-core@2.5.22
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8cmt-z8g9-duf2
1
vulnerability VCID-dbzr-zyeu-73g8
2
vulnerability VCID-gvwn-8r4r-47gm
3
vulnerability VCID-mvdz-exud-3ybz
4
vulnerability VCID-nztp-y8p8-cqc6
5
vulnerability VCID-renj-v5ce-2khx
6
vulnerability VCID-wzez-6cmp-n7gn
7
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5.22
aliases CVE-2019-0233, GHSA-ccp5-gg58-pxfm
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nm42-xrpq-7ued
29
url VCID-npge-yn8z-6fac
vulnerability_id VCID-npge-yn8z-6fac
summary 
Improper Input Validation
The REST plugin in Apache Struts 2, allows remote attackers to execute arbitrary code via a crafted expression.
references
0
reference_url http://jvndb.jvn.jp/jvndb/JVNDB-2016-000110
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url http://jvndb.jvn.jp/jvndb/JVNDB-2016-000110
1
reference_url http://jvn.jp/en/jp/JVN07710476/index.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url http://jvn.jp/en/jp/JVN07710476/index.html
2
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-4438.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-4438.json
3
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-4438
reference_id
reference_type
scores
0
value 0.62087
scoring_system epss
scoring_elements 0.98371
published_at 2026-06-05T12:55:00Z
1
value 0.62087
scoring_system epss
scoring_elements 0.98368
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-4438
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1348238
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=1348238
5
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv2
scoring_elements AV:N/AC:M/Au:N/C:P/I:P/A:P
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
6
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
7
reference_url https://github.com/apache/struts/commit/6d7ac40dcede1793a4534a3dc249fd562d495e8c
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/6d7ac40dcede1793a4534a3dc249fd562d495e8c
8
reference_url https://github.com/apache/struts/commit/76eb8f38a33ad0f1f48464ee1311559c8d52dd6d
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/76eb8f38a33ad0f1f48464ee1311559c8d52dd6d
9
reference_url https://github.com/apache/struts/commit/c9c21378f2fb2ff21355c128c45e106ebd87ad7c
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/c9c21378f2fb2ff21355c128c45e106ebd87ad7c
10
reference_url https://github.com/apache/struts/commit/deefeffd11425f0cd0b797cd86a9b3550234262b
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/deefeffd11425f0cd0b797cd86a9b3550234262b
11
reference_url https://struts.apache.org/docs/s2-037.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://struts.apache.org/docs/s2-037.html
12
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-4438
reference_id CVE-2016-4438
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-4438
13
reference_url https://github.com/advisories/GHSA-4prj-vw9j-v6pr
reference_id GHSA-4prj-vw9j-v6pr
reference_type
scores
url https://github.com/advisories/GHSA-4prj-vw9j-v6pr
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.29
purl pkg:maven/org.apache.struts/struts2-core@2.3.29
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-7hxh-btrk-skhg
2
vulnerability VCID-7uv9-4vy7-ryd1
3
vulnerability VCID-8cmt-z8g9-duf2
4
vulnerability VCID-cv6j-98vx-n3ed
5
vulnerability VCID-dbzr-zyeu-73g8
6
vulnerability VCID-dj42-wym9-nbhv
7
vulnerability VCID-dvxu-9sh6-qbef
8
vulnerability VCID-gvwn-8r4r-47gm
9
vulnerability VCID-hrky-nmnv-g3eu
10
vulnerability VCID-mmth-7rgf-aqfa
11
vulnerability VCID-mvdz-exud-3ybz
12
vulnerability VCID-nm42-xrpq-7ued
13
vulnerability VCID-nztp-y8p8-cqc6
14
vulnerability VCID-renj-v5ce-2khx
15
vulnerability VCID-vztu-pap6-37ev
16
vulnerability VCID-wzez-6cmp-n7gn
17
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.29
aliases CVE-2016-4438, GHSA-4prj-vw9j-v6pr
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-npge-yn8z-6fac
30
url VCID-nztp-y8p8-cqc6
vulnerability_id VCID-nztp-y8p8-cqc6
summary 
Remote code execution in Apache Struts
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
references
0
reference_url http://jvn.jp/en/jp/JVN43969166/index.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T20:53:17Z/
url http://jvn.jp/en/jp/JVN43969166/index.html
1
reference_url http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T20:53:17Z/
url http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html
2
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-17530.json
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-17530.json
3
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-17530
reference_id
reference_type
scores
0
value 0.94373
scoring_system epss
scoring_elements 0.99967
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-17530
4
reference_url https://cwiki.apache.org/confluence/display/WW/S2-061
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T20:53:17Z/
url https://cwiki.apache.org/confluence/display/WW/S2-061
5
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
6
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
7
reference_url https://security.netapp.com/advisory/ntap-20210115-0005
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20210115-0005
8
reference_url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17530
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17530
9
reference_url https://www.oracle.com/security-alerts/cpuApr2021.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T20:53:17Z/
url https://www.oracle.com/security-alerts/cpuApr2021.html
10
reference_url https://www.oracle.com/security-alerts/cpuapr2022.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T20:53:17Z/
url https://www.oracle.com/security-alerts/cpuapr2022.html
11
reference_url https://www.oracle.com/security-alerts/cpujan2021.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T20:53:17Z/
url https://www.oracle.com/security-alerts/cpujan2021.html
12
reference_url https://www.oracle.com/security-alerts/cpujan2022.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T20:53:17Z/
url https://www.oracle.com/security-alerts/cpujan2022.html
13
reference_url https://www.oracle.com//security-alerts/cpujul2021.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T20:53:17Z/
url https://www.oracle.com//security-alerts/cpujul2021.html
14
reference_url https://www.oracle.com/security-alerts/cpuoct2021.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T20:53:17Z/
url https://www.oracle.com/security-alerts/cpuoct2021.html
15
reference_url http://www.openwall.com/lists/oss-security/2022/04/12/6
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T20:53:17Z/
url http://www.openwall.com/lists/oss-security/2022/04/12/6
16
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1905645
reference_id 1905645
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1905645
17
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-17530
reference_id CVE-2020-17530
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-17530
18
reference_url https://github.com/advisories/GHSA-jc35-q369-45pv
reference_id GHSA-jc35-q369-45pv
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-jc35-q369-45pv
19
reference_url https://security.netapp.com/advisory/ntap-20210115-0005/
reference_id ntap-20210115-0005
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T20:53:17Z/
url https://security.netapp.com/advisory/ntap-20210115-0005/
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.5.26
purl pkg:maven/org.apache.struts/struts2-core@2.5.26
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8cmt-z8g9-duf2
1
vulnerability VCID-dbzr-zyeu-73g8
2
vulnerability VCID-gvwn-8r4r-47gm
3
vulnerability VCID-mvdz-exud-3ybz
4
vulnerability VCID-renj-v5ce-2khx
5
vulnerability VCID-wzez-6cmp-n7gn
6
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5.26
aliases CVE-2020-17530, GHSA-jc35-q369-45pv
risk_score 10.0
exploitability 2.0
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nztp-y8p8-cqc6
31
url VCID-pdny-erzd-jqhc
vulnerability_id VCID-pdny-erzd-jqhc
summary 
Apache Struts XSS Vulnerability
Apache Struts 2.x before 2.3.28 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2162.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2162.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-2162
reference_id
reference_type
scores
0
value 0.01235
scoring_system epss
scoring_elements 0.79548
published_at 2026-06-04T12:55:00Z
1
value 0.01235
scoring_system epss
scoring_elements 0.79574
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-2162
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.4
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:N/C:P/I:P/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
4
reference_url https://github.com/apache/struts/blob/f511034acd7b97e07d281169b38e2af40c94903d/core/src/main/java/org/apache/struts2/interceptor/I18nInterceptor.java
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/blob/f511034acd7b97e07d281169b38e2af40c94903d/core/src/main/java/org/apache/struts2/interceptor/I18nInterceptor.java
5
reference_url https://github.com/apache/struts/commit/fc2179cf1ac9fbfb61e3430fa88b641d87253327
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/fc2179cf1ac9fbfb61e3430fa88b641d87253327
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-2162
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-2162
7
reference_url http://struts.apache.org/docs/s2-030.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://struts.apache.org/docs/s2-030.html
8
reference_url https://web.archive.org/web/20210123095722/http://www.securityfocus.com/bid/85070
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20210123095722/http://www.securityfocus.com/bid/85070
9
reference_url https://web.archive.org/web/20210801130539/http://www.securitytracker.com/id/1035272
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20210801130539/http://www.securitytracker.com/id/1035272
10
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1326724
reference_id 1326724
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1326724
11
reference_url https://github.com/advisories/GHSA-2j4q-9fff-236j
reference_id GHSA-2j4q-9fff-236j
reference_type
scores
url https://github.com/advisories/GHSA-2j4q-9fff-236j
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.28
purl pkg:maven/org.apache.struts/struts2-core@2.3.28
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1cxn-qv1w-2kh7
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-4bzw-ges2-d7ek
3
vulnerability VCID-6dfe-8yy4-kkfj
4
vulnerability VCID-7hxh-btrk-skhg
5
vulnerability VCID-7uv9-4vy7-ryd1
6
vulnerability VCID-8cmt-z8g9-duf2
7
vulnerability VCID-cv6j-98vx-n3ed
8
vulnerability VCID-dbzr-zyeu-73g8
9
vulnerability VCID-dj42-wym9-nbhv
10
vulnerability VCID-dvxu-9sh6-qbef
11
vulnerability VCID-gvwn-8r4r-47gm
12
vulnerability VCID-hrky-nmnv-g3eu
13
vulnerability VCID-jzbz-jpe1-cycg
14
vulnerability VCID-mmth-7rgf-aqfa
15
vulnerability VCID-mvdz-exud-3ybz
16
vulnerability VCID-nm42-xrpq-7ued
17
vulnerability VCID-npge-yn8z-6fac
18
vulnerability VCID-nztp-y8p8-cqc6
19
vulnerability VCID-qdsq-8td3-5qa1
20
vulnerability VCID-renj-v5ce-2khx
21
vulnerability VCID-vztu-pap6-37ev
22
vulnerability VCID-wzez-6cmp-n7gn
23
vulnerability VCID-z1jy-4da2-tyhk
24
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.28
aliases CVE-2016-2162, GHSA-2j4q-9fff-236j
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-pdny-erzd-jqhc
32
url VCID-q2ad-khtm-nqdr
vulnerability_id VCID-q2ad-khtm-nqdr
summary 
Improper Input Validation
Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-3093.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-3093.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-3093
reference_id
reference_type
scores
0
value 0.05068
scoring_system epss
scoring_elements 0.89958
published_at 2026-06-04T12:55:00Z
1
value 0.05068
scoring_system epss
scoring_elements 0.89974
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-3093
2
reference_url https://github.com/jkuhnert/ognl/commit/ae43073fbf38db8371ff4f8bf2a966ee3b5f7e92
reference_id
reference_type
scores
url https://github.com/jkuhnert/ognl/commit/ae43073fbf38db8371ff4f8bf2a966ee3b5f7e92
3
reference_url https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E
4
reference_url https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E
5
reference_url https://struts.apache.org/docs/s2-034.html
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://struts.apache.org/docs/s2-034.html
6
reference_url http://struts.apache.org/docs/s2-034.html
reference_id
reference_type
scores
url http://struts.apache.org/docs/s2-034.html
7
reference_url http://www-01.ibm.com/support/docview.wss?uid=swg21987854
reference_id
reference_type
scores
url http://www-01.ibm.com/support/docview.wss?uid=swg21987854
8
reference_url http://www.securityfocus.com/bid/90961
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/90961
9
reference_url http://www.securitytracker.com/id/1036018
reference_id
reference_type
scores
url http://www.securitytracker.com/id/1036018
10
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1341677
reference_id 1341677
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1341677
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-3093
reference_id CVE-2016-3093
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-3093
12
reference_url https://github.com/advisories/GHSA-383p-xqxx-rrmp
reference_id GHSA-383p-xqxx-rrmp
reference_type
scores
url https://github.com/advisories/GHSA-383p-xqxx-rrmp
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.24.3
purl pkg:maven/org.apache.struts/struts2-core@2.3.24.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-4bzw-ges2-d7ek
2
vulnerability VCID-7hxh-btrk-skhg
3
vulnerability VCID-7uv9-4vy7-ryd1
4
vulnerability VCID-8cmt-z8g9-duf2
5
vulnerability VCID-cv6j-98vx-n3ed
6
vulnerability VCID-dbzr-zyeu-73g8
7
vulnerability VCID-dj42-wym9-nbhv
8
vulnerability VCID-dvxu-9sh6-qbef
9
vulnerability VCID-gvwn-8r4r-47gm
10
vulnerability VCID-hrky-nmnv-g3eu
11
vulnerability VCID-jzbz-jpe1-cycg
12
vulnerability VCID-mmth-7rgf-aqfa
13
vulnerability VCID-mvdz-exud-3ybz
14
vulnerability VCID-nm42-xrpq-7ued
15
vulnerability VCID-npge-yn8z-6fac
16
vulnerability VCID-nztp-y8p8-cqc6
17
vulnerability VCID-pdny-erzd-jqhc
18
vulnerability VCID-qdsq-8td3-5qa1
19
vulnerability VCID-renj-v5ce-2khx
20
vulnerability VCID-vztu-pap6-37ev
21
vulnerability VCID-wzez-6cmp-n7gn
22
vulnerability VCID-xgnf-d44x-kfc9
23
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.24.3
aliases CVE-2016-3093, GHSA-383p-xqxx-rrmp
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-q2ad-khtm-nqdr
33
url VCID-renj-v5ce-2khx
vulnerability_id VCID-renj-v5ce-2khx
summary 
Apache Struts vulnerable to memory exhaustion
Denial of service via out of memory (OOM) owing to no sanity limit on normal form fields in multipart forms. When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings without checking their sizes. This could lead to an OOM if developer has set struts.multipart.maxSize to a value equal or greater than the available memory.

Upgrade to Struts 2.5.31 or 6.1.2.1 or greater
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-34396
reference_id
reference_type
scores
0
value 0.00123
scoring_system epss
scoring_elements 0.30995
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-34396
1
reference_url https://cwiki.apache.org/confluence/display/WW/S2-064
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-09T14:04:35Z/
url https://cwiki.apache.org/confluence/display/WW/S2-064
2
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
3
reference_url https://github.com/apache/struts/commit/2d6f1bc0a6f5ac575a56784ac6461816b67c4f21
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/2d6f1bc0a6f5ac575a56784ac6461816b67c4f21
4
reference_url https://github.com/apache/struts/releases/tag/STRUTS_2_5_31
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/releases/tag/STRUTS_2_5_31
5
reference_url https://github.com/apache/struts/releases/tag/STRUTS_6_1_2_1
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/releases/tag/STRUTS_6_1_2_1
6
reference_url https://security.netapp.com/advisory/ntap-20230706-0005
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20230706-0005
7
reference_url http://www.openwall.com/lists/oss-security/2023/06/14/3
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-09T14:04:35Z/
url http://www.openwall.com/lists/oss-security/2023/06/14/3
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-34396
reference_id CVE-2023-34396
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-34396
9
reference_url https://github.com/advisories/GHSA-4g42-gqrg-4633
reference_id GHSA-4g42-gqrg-4633
reference_type
scores
url https://github.com/advisories/GHSA-4g42-gqrg-4633
10
reference_url https://security.netapp.com/advisory/ntap-20230706-0005/
reference_id ntap-20230706-0005
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-09T14:04:35Z/
url https://security.netapp.com/advisory/ntap-20230706-0005/
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.5.31
purl pkg:maven/org.apache.struts/struts2-core@2.5.31
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8cmt-z8g9-duf2
1
vulnerability VCID-gvwn-8r4r-47gm
2
vulnerability VCID-mvdz-exud-3ybz
3
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5.31
1
url pkg:maven/org.apache.struts/struts2-core@6.1.2.1
purl pkg:maven/org.apache.struts/struts2-core@6.1.2.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gvwn-8r4r-47gm
1
vulnerability VCID-mvdz-exud-3ybz
2
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@6.1.2.1
aliases CVE-2023-34396, GHSA-4g42-gqrg-4633
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-renj-v5ce-2khx
34
url VCID-t1s3-f181-tqca
vulnerability_id VCID-t1s3-f181-tqca
summary 
Cross-site Scripting
Apache Struts has a cross-site scripting (XSS) vulnerability.
references
0
reference_url http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000124.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000124.html
1
reference_url http://jvn.jp/en/jp/JVN88408929/index.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://jvn.jp/en/jp/JVN88408929/index.html
2
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-2992.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-2992.json
3
reference_url https://api.first.org/data/v1/epss?cve=CVE-2015-2992
reference_id
reference_type
scores
0
value 0.00992
scoring_system epss
scoring_elements 0.77278
published_at 2026-06-05T12:55:00Z
1
value 0.00992
scoring_system epss
scoring_elements 0.77248
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2015-2992
4
reference_url https://cwiki.apache.org/confluence/display/WW/S2-025
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://cwiki.apache.org/confluence/display/WW/S2-025
5
reference_url https://cwiki.apache.org/confluence/display/WW/Security
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://cwiki.apache.org/confluence/display/WW/Security
6
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
7
reference_url https://security.netapp.com/advisory/ntap-20200330-0001
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20200330-0001
8
reference_url http://www.securityfocus.com/bid/76624
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.securityfocus.com/bid/76624
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1260101
reference_id 1260101
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1260101
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2015-2992
reference_id CVE-2015-2992
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2015-2992
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.20
purl pkg:maven/org.apache.struts/struts2-core@2.3.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1cxn-qv1w-2kh7
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-4bzw-ges2-d7ek
3
vulnerability VCID-4t8h-s9mh-p7c4
4
vulnerability VCID-6dfe-8yy4-kkfj
5
vulnerability VCID-7hxh-btrk-skhg
6
vulnerability VCID-7uv9-4vy7-ryd1
7
vulnerability VCID-8cmt-z8g9-duf2
8
vulnerability VCID-9mn7-d2mm-uqay
9
vulnerability VCID-cv6j-98vx-n3ed
10
vulnerability VCID-dbzr-zyeu-73g8
11
vulnerability VCID-dj42-wym9-nbhv
12
vulnerability VCID-dvxu-9sh6-qbef
13
vulnerability VCID-fwkj-x53j-yqd8
14
vulnerability VCID-gvwn-8r4r-47gm
15
vulnerability VCID-hrky-nmnv-g3eu
16
vulnerability VCID-jzbz-jpe1-cycg
17
vulnerability VCID-mmth-7rgf-aqfa
18
vulnerability VCID-mvdz-exud-3ybz
19
vulnerability VCID-nm42-xrpq-7ued
20
vulnerability VCID-npge-yn8z-6fac
21
vulnerability VCID-nztp-y8p8-cqc6
22
vulnerability VCID-pdny-erzd-jqhc
23
vulnerability VCID-q2ad-khtm-nqdr
24
vulnerability VCID-qdsq-8td3-5qa1
25
vulnerability VCID-renj-v5ce-2khx
26
vulnerability VCID-vztu-pap6-37ev
27
vulnerability VCID-wzez-6cmp-n7gn
28
vulnerability VCID-xgnf-d44x-kfc9
29
vulnerability VCID-z1jy-4da2-tyhk
30
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.20
aliases CVE-2015-2992, GHSA-265r-pp83-gww7
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-t1s3-f181-tqca
35
url VCID-vztu-pap6-37ev
vulnerability_id VCID-vztu-pap6-37ev
summary 
Apache Struts vulnerable to remote arbitrary command execution due to improper input validation
Apache Struts versions prior to 2.3.32 and 2.5.10.1 contain incorrect exception handling and error-message generation during file-upload attempts using the Jakarta Multipart parser, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
references
0
reference_url http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html
1
reference_url http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution
2
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-5638.json
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-5638.json
3
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-5638
reference_id
reference_type
scores
0
value 0.94267
scoring_system epss
scoring_elements 0.99939
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-5638
4
reference_url https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites
5
reference_url https://cwiki.apache.org/confluence/display/WW/S2-045
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://cwiki.apache.org/confluence/display/WW/S2-045
6
reference_url https://cwiki.apache.org/confluence/display/WW/S2-046
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://cwiki.apache.org/confluence/display/WW/S2-046
7
reference_url https://exploit-db.com/exploits/41570
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://exploit-db.com/exploits/41570
8
reference_url https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a
9
reference_url https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228
10
reference_url https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=352306493971e7d5a756d61780d57a76eb1f519a
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=352306493971e7d5a756d61780d57a76eb1f519a
11
reference_url https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=6b8272ce47160036ed120a48345d9aa884477228
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=6b8272ce47160036ed120a48345d9aa884477228
12
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
13
reference_url https://github.com/apache/struts/commit/352306493971e7d5a756d61780d57a76eb1f519a
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/352306493971e7d5a756d61780d57a76eb1f519a
14
reference_url https://github.com/apache/struts/commit/6b8272ce47160036ed120a48345d9aa884477228
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/6b8272ce47160036ed120a48345d9aa884477228
15
reference_url https://github.com/apache/struts/commit/b06dd50af2a3319dd896bf5c2f4972d2b772cf2b
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/b06dd50af2a3319dd896bf5c2f4972d2b772cf2b
16
reference_url https://github.com/mazen160/struts-pwn
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://github.com/mazen160/struts-pwn
17
reference_url https://github.com/rapid7/metasploit-framework/issues/8064
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://github.com/rapid7/metasploit-framework/issues/8064
18
reference_url https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us
19
reference_url https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us
20
reference_url https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us
21
reference_url https://isc.sans.edu/diary/22169
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://isc.sans.edu/diary/22169
22
reference_url https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7@%3Cannounce.apache.org%3E
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7@%3Cannounce.apache.org%3E
23
reference_url https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E
24
reference_url https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E
25
reference_url https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
26
reference_url https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922@%3Cannounce.apache.org%3E
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922@%3Cannounce.apache.org%3E
27
reference_url https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E
28
reference_url https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html
29
reference_url https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt
30
reference_url https://security.netapp.com/advisory/ntap-20170310-0001
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20170310-0001
31
reference_url https://struts.apache.org/docs/s2-045.html
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://struts.apache.org/docs/s2-045.html
32
reference_url https://struts.apache.org/docs/s2-046.html
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://struts.apache.org/docs/s2-046.html
33
reference_url https://support.lenovo.com/us/en/product_security/len-14200
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://support.lenovo.com/us/en/product_security/len-14200
34
reference_url https://twitter.com/theog150/status/841146956135124993
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://twitter.com/theog150/status/841146956135124993
35
reference_url https://web.archive.org/web/20170311203630/http://www.securityfocus.com/bid/96729
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20170311203630/http://www.securityfocus.com/bid/96729
36
reference_url https://web.archive.org/web/20170921030226/http://www.securitytracker.com/id/1037973
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20170921030226/http://www.securitytracker.com/id/1037973
37
reference_url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5638
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5638
38
reference_url https://www.exploit-db.com/exploits/41614
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.exploit-db.com/exploits/41614
39
reference_url https://www.kb.cert.org/vuls/id/834067
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://www.kb.cert.org/vuls/id/834067
40
reference_url https://www.symantec.com/security-center/network-protection-security-advisories/SA145
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://www.symantec.com/security-center/network-protection-security-advisories/SA145
41
reference_url http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt
42
reference_url http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html
43
reference_url http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
44
reference_url http://www.securityfocus.com/bid/96729
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url http://www.securityfocus.com/bid/96729
45
reference_url http://www.securitytracker.com/id/1037973
reference_id
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url http://www.securitytracker.com/id/1037973
46
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1430326
reference_id 1430326
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1430326
47
reference_url https://www.exploit-db.com/exploits/41614/
reference_id 41614
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://www.exploit-db.com/exploits/41614/
48
reference_url https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/
reference_id critical-vulnerability-under-massive-attack-imperils-high-impact-sites
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/
49
reference_url https://github.com/nixawk/labs/tree/17cf725d64f33ef51b820dea4fc1e6133f579d64/CVE-2017-5638
reference_id CVE-2017-5638
reference_type exploit
scores
url https://github.com/nixawk/labs/tree/17cf725d64f33ef51b820dea4fc1e6133f579d64/CVE-2017-5638
50
reference_url https://github.com/rapid7/metasploit-framework/blob/173633263853c7717caa658a9b98350b985cda02/modules/exploits/multi/http/struts2_content_type_ognl.rb
reference_id CVE-2017-5638
reference_type exploit
scores
url https://github.com/rapid7/metasploit-framework/blob/173633263853c7717caa658a9b98350b985cda02/modules/exploits/multi/http/struts2_content_type_ognl.rb
51
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/webapps/41570.py
reference_id CVE-2017-5638
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/webapps/41570.py
52
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/41614.rb
reference_id CVE-2017-5638
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/41614.rb
53
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-5638
reference_id CVE-2017-5638
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2017-5638
54
reference_url http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/
reference_id cve-2017-5638-apache-struts-vulnerability-remote-code-execution
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/
55
reference_url https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/
reference_id cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/
56
reference_url https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2
reference_id CVE-2017-5638-NEW-REMOTE-CODE-EXECUTION-RCE-VULNERABILITY-IN-APACHE-STRUTS-2
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2
57
reference_url https://github.com/advisories/GHSA-j77q-2qqg-6989
reference_id GHSA-j77q-2qqg-6989
reference_type
scores
0
value 10.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-j77q-2qqg-6989
58
reference_url https://security.netapp.com/advisory/ntap-20170310-0001/
reference_id ntap-20170310-0001
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-06T21:06:33Z/
url https://security.netapp.com/advisory/ntap-20170310-0001/
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.32
purl pkg:maven/org.apache.struts/struts2-core@2.3.32
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-7hxh-btrk-skhg
2
vulnerability VCID-7uv9-4vy7-ryd1
3
vulnerability VCID-8cmt-z8g9-duf2
4
vulnerability VCID-dbzr-zyeu-73g8
5
vulnerability VCID-dj42-wym9-nbhv
6
vulnerability VCID-dvxu-9sh6-qbef
7
vulnerability VCID-gvwn-8r4r-47gm
8
vulnerability VCID-hrky-nmnv-g3eu
9
vulnerability VCID-mmth-7rgf-aqfa
10
vulnerability VCID-mvdz-exud-3ybz
11
vulnerability VCID-nm42-xrpq-7ued
12
vulnerability VCID-nztp-y8p8-cqc6
13
vulnerability VCID-renj-v5ce-2khx
14
vulnerability VCID-wzez-6cmp-n7gn
15
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.32
1
url pkg:maven/org.apache.struts/struts2-core@2.5.10.1
purl pkg:maven/org.apache.struts/struts2-core@2.5.10.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-21k4-5a8r-7bd9
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-7hxh-btrk-skhg
3
vulnerability VCID-7uv9-4vy7-ryd1
4
vulnerability VCID-8cmt-z8g9-duf2
5
vulnerability VCID-dbzr-zyeu-73g8
6
vulnerability VCID-dj42-wym9-nbhv
7
vulnerability VCID-dvxu-9sh6-qbef
8
vulnerability VCID-gvwn-8r4r-47gm
9
vulnerability VCID-hrky-nmnv-g3eu
10
vulnerability VCID-mmth-7rgf-aqfa
11
vulnerability VCID-mvdz-exud-3ybz
12
vulnerability VCID-nm42-xrpq-7ued
13
vulnerability VCID-nztp-y8p8-cqc6
14
vulnerability VCID-renj-v5ce-2khx
15
vulnerability VCID-wzez-6cmp-n7gn
16
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5.10.1
aliases CVE-2017-5638, GHSA-j77q-2qqg-6989
risk_score 10.0
exploitability 2.0
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vztu-pap6-37ev
36
url VCID-wtca-5ffw-w7bc
vulnerability_id VCID-wtca-5ffw-w7bc
summary 
Predictable CSRF token
This package uses predictable `<s:token/>` values, which allows remote attackers to bypass the CSRF protection mechanism.
references
0
reference_url http://blog.h3xstream.com/2014/12/predicting-struts-csrf-token-cve-2014.html
reference_id
reference_type
scores
url http://blog.h3xstream.com/2014/12/predicting-struts-csrf-token-cve-2014.html
1
reference_url http://packetstormsecurity.com/files/129421/Apache-Struts-2.3.20-Security-Fixes.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://packetstormsecurity.com/files/129421/Apache-Struts-2.3.20-Security-Fixes.html
2
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-7809.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-7809.json
3
reference_url https://api.first.org/data/v1/epss?cve=CVE-2014-7809
reference_id
reference_type
scores
0
value 0.07545
scoring_system epss
scoring_elements 0.91979
published_at 2026-06-05T12:55:00Z
1
value 0.07545
scoring_system epss
scoring_elements 0.91966
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2014-7809
4
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
5
reference_url https://github.com/apache/struts/commit/1f301038a751bf16e525607c3db513db835b2999
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/1f301038a751bf16e525607c3db513db835b2999
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2014-7809
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2014-7809
7
reference_url http://struts.apache.org/docs/s2-023.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url http://struts.apache.org/docs/s2-023.html
8
reference_url https://web.archive.org/web/20150201180327/http://www.securitytracker.com/id/1031309
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20150201180327/http://www.securitytracker.com/id/1031309
9
reference_url https://web.archive.org/web/20150820131625/http://www.securityfocus.com/bid/71548
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20150820131625/http://www.securityfocus.com/bid/71548
10
reference_url https://web.archive.org/web/20201023114849/http://www.securityfocus.com/archive/1/534175/100/0/threaded
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20201023114849/http://www.securityfocus.com/archive/1/534175/100/0/threaded
11
reference_url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7809
reference_id
reference_type
scores
url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7809
12
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1172133
reference_id 1172133
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1172133
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.20
purl pkg:maven/org.apache.struts/struts2-core@2.3.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1cxn-qv1w-2kh7
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-4bzw-ges2-d7ek
3
vulnerability VCID-4t8h-s9mh-p7c4
4
vulnerability VCID-6dfe-8yy4-kkfj
5
vulnerability VCID-7hxh-btrk-skhg
6
vulnerability VCID-7uv9-4vy7-ryd1
7
vulnerability VCID-8cmt-z8g9-duf2
8
vulnerability VCID-9mn7-d2mm-uqay
9
vulnerability VCID-cv6j-98vx-n3ed
10
vulnerability VCID-dbzr-zyeu-73g8
11
vulnerability VCID-dj42-wym9-nbhv
12
vulnerability VCID-dvxu-9sh6-qbef
13
vulnerability VCID-fwkj-x53j-yqd8
14
vulnerability VCID-gvwn-8r4r-47gm
15
vulnerability VCID-hrky-nmnv-g3eu
16
vulnerability VCID-jzbz-jpe1-cycg
17
vulnerability VCID-mmth-7rgf-aqfa
18
vulnerability VCID-mvdz-exud-3ybz
19
vulnerability VCID-nm42-xrpq-7ued
20
vulnerability VCID-npge-yn8z-6fac
21
vulnerability VCID-nztp-y8p8-cqc6
22
vulnerability VCID-pdny-erzd-jqhc
23
vulnerability VCID-q2ad-khtm-nqdr
24
vulnerability VCID-qdsq-8td3-5qa1
25
vulnerability VCID-renj-v5ce-2khx
26
vulnerability VCID-vztu-pap6-37ev
27
vulnerability VCID-wzez-6cmp-n7gn
28
vulnerability VCID-xgnf-d44x-kfc9
29
vulnerability VCID-z1jy-4da2-tyhk
30
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.20
aliases CVE-2014-7809, GHSA-h4v9-jf2r-9h6m
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wtca-5ffw-w7bc
37
url VCID-wzez-6cmp-n7gn
vulnerability_id VCID-wzez-6cmp-n7gn
summary 
Apache Struts vulnerable to memory exhaustion
Denial of service via out of memory (OOM) owing to not properly checking of list bounds. When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings without checking their sizes. This could lead to OOM if developer has set struts.multipart.maxSize to a value equal or greater than the available memory.

Upgrade to Struts 2.5.31 or 6.1.2.1 or greater.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-34149
reference_id
reference_type
scores
0
value 0.00066
scoring_system epss
scoring_elements 0.20831
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-34149
1
reference_url https://cwiki.apache.org/confluence/display/WW/S2-063
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
1
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-09T14:02:16Z/
url https://cwiki.apache.org/confluence/display/WW/S2-063
2
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
3
reference_url https://github.com/apache/struts/commit/2d6f1bc0a6f5ac575a56784ac6461816b67c4f21
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/2d6f1bc0a6f5ac575a56784ac6461816b67c4f21
4
reference_url https://github.com/apache/struts/releases/tag/STRUTS_2_5_31
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/releases/tag/STRUTS_2_5_31
5
reference_url https://github.com/apache/struts/releases/tag/STRUTS_6_1_2_1
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/releases/tag/STRUTS_6_1_2_1
6
reference_url https://security.netapp.com/advisory/ntap-20230706-0005
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20230706-0005
7
reference_url http://www.openwall.com/lists/oss-security/2023/06/14/2
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
1
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-09T14:02:16Z/
url http://www.openwall.com/lists/oss-security/2023/06/14/2
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-34149
reference_id CVE-2023-34149
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-34149
9
reference_url https://github.com/advisories/GHSA-8f6x-v685-g2xc
reference_id GHSA-8f6x-v685-g2xc
reference_type
scores
url https://github.com/advisories/GHSA-8f6x-v685-g2xc
10
reference_url https://security.netapp.com/advisory/ntap-20230706-0005/
reference_id ntap-20230706-0005
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-09T14:02:16Z/
url https://security.netapp.com/advisory/ntap-20230706-0005/
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.5.31
purl pkg:maven/org.apache.struts/struts2-core@2.5.31
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8cmt-z8g9-duf2
1
vulnerability VCID-gvwn-8r4r-47gm
2
vulnerability VCID-mvdz-exud-3ybz
3
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.5.31
1
url pkg:maven/org.apache.struts/struts2-core@6.1.2.1
purl pkg:maven/org.apache.struts/struts2-core@6.1.2.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gvwn-8r4r-47gm
1
vulnerability VCID-mvdz-exud-3ybz
2
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@6.1.2.1
aliases CVE-2023-34149, GHSA-8f6x-v685-g2xc
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wzez-6cmp-n7gn
38
url VCID-xgnf-d44x-kfc9
vulnerability_id VCID-xgnf-d44x-kfc9
summary 
Improper Input Validation
Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-0785.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-0785.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-0785
reference_id
reference_type
scores
0
value 0.13414
scoring_system epss
scoring_elements 0.94324
published_at 2026-06-04T12:55:00Z
1
value 0.13414
scoring_system epss
scoring_elements 0.94333
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-0785
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv2
scoring_elements AV:N/AC:M/Au:N/C:P/I:P/A:P
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
4
reference_url https://github.com/apache/struts/commit/15857a69e7baf3675804495a5954cd0756ac8364
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/15857a69e7baf3675804495a5954cd0756ac8364
5
reference_url http://struts.apache.org/docs/s2-029.html
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://struts.apache.org/docs/s2-029.html
6
reference_url https://web.archive.org/web/20210123095715/http://www.securityfocus.com/bid/85066
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20210123095715/http://www.securityfocus.com/bid/85066
7
reference_url https://web.archive.org/web/20220118185853/http://www.securitytracker.com/id/1035271
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20220118185853/http://www.securitytracker.com/id/1035271
8
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1326720
reference_id 1326720
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1326720
9
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-0785
reference_id CVE-2016-0785
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-0785
10
reference_url https://github.com/advisories/GHSA-876p-4wgc-75rx
reference_id GHSA-876p-4wgc-75rx
reference_type
scores
url https://github.com/advisories/GHSA-876p-4wgc-75rx
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.20.3
purl pkg:maven/org.apache.struts/struts2-core@2.3.20.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-4bzw-ges2-d7ek
2
vulnerability VCID-7hxh-btrk-skhg
3
vulnerability VCID-7uv9-4vy7-ryd1
4
vulnerability VCID-8cmt-z8g9-duf2
5
vulnerability VCID-9mn7-d2mm-uqay
6
vulnerability VCID-cv6j-98vx-n3ed
7
vulnerability VCID-dbzr-zyeu-73g8
8
vulnerability VCID-dj42-wym9-nbhv
9
vulnerability VCID-fwkj-x53j-yqd8
10
vulnerability VCID-gvwn-8r4r-47gm
11
vulnerability VCID-jzbz-jpe1-cycg
12
vulnerability VCID-mmth-7rgf-aqfa
13
vulnerability VCID-mvdz-exud-3ybz
14
vulnerability VCID-nm42-xrpq-7ued
15
vulnerability VCID-npge-yn8z-6fac
16
vulnerability VCID-nztp-y8p8-cqc6
17
vulnerability VCID-pdny-erzd-jqhc
18
vulnerability VCID-q2ad-khtm-nqdr
19
vulnerability VCID-qdsq-8td3-5qa1
20
vulnerability VCID-renj-v5ce-2khx
21
vulnerability VCID-vztu-pap6-37ev
22
vulnerability VCID-wzez-6cmp-n7gn
23
vulnerability VCID-xgnf-d44x-kfc9
24
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.20.3
1
url pkg:maven/org.apache.struts/struts2-core@2.3.24.3
purl pkg:maven/org.apache.struts/struts2-core@2.3.24.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-4bzw-ges2-d7ek
2
vulnerability VCID-7hxh-btrk-skhg
3
vulnerability VCID-7uv9-4vy7-ryd1
4
vulnerability VCID-8cmt-z8g9-duf2
5
vulnerability VCID-cv6j-98vx-n3ed
6
vulnerability VCID-dbzr-zyeu-73g8
7
vulnerability VCID-dj42-wym9-nbhv
8
vulnerability VCID-dvxu-9sh6-qbef
9
vulnerability VCID-gvwn-8r4r-47gm
10
vulnerability VCID-hrky-nmnv-g3eu
11
vulnerability VCID-jzbz-jpe1-cycg
12
vulnerability VCID-mmth-7rgf-aqfa
13
vulnerability VCID-mvdz-exud-3ybz
14
vulnerability VCID-nm42-xrpq-7ued
15
vulnerability VCID-npge-yn8z-6fac
16
vulnerability VCID-nztp-y8p8-cqc6
17
vulnerability VCID-pdny-erzd-jqhc
18
vulnerability VCID-qdsq-8td3-5qa1
19
vulnerability VCID-renj-v5ce-2khx
20
vulnerability VCID-vztu-pap6-37ev
21
vulnerability VCID-wzez-6cmp-n7gn
22
vulnerability VCID-xgnf-d44x-kfc9
23
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.24.3
2
url pkg:maven/org.apache.struts/struts2-core@2.3.28
purl pkg:maven/org.apache.struts/struts2-core@2.3.28
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1cxn-qv1w-2kh7
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-4bzw-ges2-d7ek
3
vulnerability VCID-6dfe-8yy4-kkfj
4
vulnerability VCID-7hxh-btrk-skhg
5
vulnerability VCID-7uv9-4vy7-ryd1
6
vulnerability VCID-8cmt-z8g9-duf2
7
vulnerability VCID-cv6j-98vx-n3ed
8
vulnerability VCID-dbzr-zyeu-73g8
9
vulnerability VCID-dj42-wym9-nbhv
10
vulnerability VCID-dvxu-9sh6-qbef
11
vulnerability VCID-gvwn-8r4r-47gm
12
vulnerability VCID-hrky-nmnv-g3eu
13
vulnerability VCID-jzbz-jpe1-cycg
14
vulnerability VCID-mmth-7rgf-aqfa
15
vulnerability VCID-mvdz-exud-3ybz
16
vulnerability VCID-nm42-xrpq-7ued
17
vulnerability VCID-npge-yn8z-6fac
18
vulnerability VCID-nztp-y8p8-cqc6
19
vulnerability VCID-qdsq-8td3-5qa1
20
vulnerability VCID-renj-v5ce-2khx
21
vulnerability VCID-vztu-pap6-37ev
22
vulnerability VCID-wzez-6cmp-n7gn
23
vulnerability VCID-z1jy-4da2-tyhk
24
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.28
aliases CVE-2016-0785, GHSA-876p-4wgc-75rx
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-xgnf-d44x-kfc9
39
url VCID-xpa5-fsb6-ukay
vulnerability_id VCID-xpa5-fsb6-ukay
summary 
Code injection in Apache Struts
The Struts 2 DefaultActionMapper supports a method for short-circuit navigation state changes by prefixing parameters with "action:" or "redirect:", followed by a desired navigational target expression. This mechanism was intended to help with attaching navigational information to buttons within forms.

In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
references
0
reference_url http://archiva.apache.org/security.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T13:24:31Z/
url http://archiva.apache.org/security.html
1
reference_url http://cxsecurity.com/issue/WLB-2014010087
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T13:24:31Z/
url http://cxsecurity.com/issue/WLB-2014010087
2
reference_url http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T13:24:31Z/
url http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html
3
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-2251
reference_id
reference_type
scores
0
value 0.94325
scoring_system epss
scoring_elements 0.99954
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-2251
4
reference_url http://seclists.org/fulldisclosure/2013/Oct/96
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T13:24:31Z/
url http://seclists.org/fulldisclosure/2013/Oct/96
5
reference_url http://seclists.org/oss-sec/2014/q1/89
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T13:24:31Z/
url http://seclists.org/oss-sec/2014/q1/89
6
reference_url https://exchange.xforce.ibmcloud.com/vulnerabilities/90392
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T13:24:31Z/
url https://exchange.xforce.ibmcloud.com/vulnerabilities/90392
7
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
8
reference_url https://github.com/apache/struts/commit/3cfe34fefedcf0fdcfcb061c0aea34a715b7de6
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/3cfe34fefedcf0fdcfcb061c0aea34a715b7de6
9
reference_url https://github.com/apache/struts/commit/630e1ba065a8215c4e9ac03bfb09be9d655c2b6e
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/630e1ba065a8215c4e9ac03bfb09be9d655c2b6e
10
reference_url https://issues.apache.org/jira/browse/WW-4140
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://issues.apache.org/jira/browse/WW-4140
11
reference_url http://struts.apache.org/release/2.3.x/docs/s2-016.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T13:24:31Z/
url http://struts.apache.org/release/2.3.x/docs/s2-016.html
12
reference_url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2251
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2251
13
reference_url http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T13:24:31Z/
url http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2
14
reference_url http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T13:24:31Z/
url http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html
15
reference_url http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T13:24:31Z/
url http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
16
reference_url http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T13:24:31Z/
url http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
17
reference_url http://www.securitytracker.com/id/1029184
reference_id 1029184
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T13:24:31Z/
url http://www.securitytracker.com/id/1029184
18
reference_url http://www.securitytracker.com/id/1032916
reference_id 1032916
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T13:24:31Z/
url http://www.securitytracker.com/id/1032916
19
reference_url http://www.securityfocus.com/bid/61189
reference_id 61189
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T13:24:31Z/
url http://www.securityfocus.com/bid/61189
20
reference_url http://osvdb.org/98445
reference_id 98445
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value Act
scoring_system ssvc
scoring_elements SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T13:24:31Z/
url http://osvdb.org/98445
21
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/44583.txt
reference_id CVE-2013-2251
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/44583.txt
22
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-2251
reference_id CVE-2013-2251
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-2251
23
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/27135.rb
reference_id CVE-2013-2251;OSVDB-95405
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/27135.rb
24
reference_url https://github.com/advisories/GHSA-47qp-8v9g-39hp
reference_id GHSA-47qp-8v9g-39hp
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-47qp-8v9g-39hp
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.15.1
purl pkg:maven/org.apache.struts/struts2-core@2.3.15.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1uv2-rvmy-53hk
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-4bzw-ges2-d7ek
3
vulnerability VCID-4ywn-n1my-83ev
4
vulnerability VCID-7hxh-btrk-skhg
5
vulnerability VCID-7uv9-4vy7-ryd1
6
vulnerability VCID-84ge-vq7u-j3ar
7
vulnerability VCID-8cmt-z8g9-duf2
8
vulnerability VCID-8jup-umjw-9ba4
9
vulnerability VCID-9mn7-d2mm-uqay
10
vulnerability VCID-cv6j-98vx-n3ed
11
vulnerability VCID-dbzr-zyeu-73g8
12
vulnerability VCID-dj42-wym9-nbhv
13
vulnerability VCID-dvxu-9sh6-qbef
14
vulnerability VCID-fvde-37ch-z7cg
15
vulnerability VCID-fwkj-x53j-yqd8
16
vulnerability VCID-ghqg-ae1b-w7br
17
vulnerability VCID-gvwn-8r4r-47gm
18
vulnerability VCID-hrky-nmnv-g3eu
19
vulnerability VCID-jzbz-jpe1-cycg
20
vulnerability VCID-kmqa-hsqy-muf1
21
vulnerability VCID-m39c-3bv2-6ugy
22
vulnerability VCID-mmth-7rgf-aqfa
23
vulnerability VCID-mvdz-exud-3ybz
24
vulnerability VCID-nm42-xrpq-7ued
25
vulnerability VCID-npge-yn8z-6fac
26
vulnerability VCID-nztp-y8p8-cqc6
27
vulnerability VCID-pdny-erzd-jqhc
28
vulnerability VCID-q2ad-khtm-nqdr
29
vulnerability VCID-renj-v5ce-2khx
30
vulnerability VCID-t1s3-f181-tqca
31
vulnerability VCID-vztu-pap6-37ev
32
vulnerability VCID-wtca-5ffw-w7bc
33
vulnerability VCID-wzez-6cmp-n7gn
34
vulnerability VCID-xgnf-d44x-kfc9
35
vulnerability VCID-z1jy-4da2-tyhk
36
vulnerability VCID-z6wr-3psx-dbfm
37
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.15.1
aliases CVE-2013-2251, GHSA-47qp-8v9g-39hp
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-xpa5-fsb6-ukay
40
url VCID-z1jy-4da2-tyhk
vulnerability_id VCID-z1jy-4da2-tyhk
summary 
Improper Input Validation
`XSLTResult` in Apache Struts allows remote attackers to execute arbitrary code via the stylesheet location parameter.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-3082
reference_id
reference_type
scores
0
value 0.24626
scoring_system epss
scoring_elements 0.96233
published_at 2026-06-04T12:55:00Z
1
value 0.24626
scoring_system epss
scoring_elements 0.96238
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-3082
1
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
2
reference_url https://github.com/apache/struts/commit/6bd694b7980494c12d49ca1bf39f12aec3e03e2f
reference_id
reference_type
scores
url https://github.com/apache/struts/commit/6bd694b7980494c12d49ca1bf39f12aec3e03e2f
3
reference_url http://struts.apache.org/docs/s2-031.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url http://struts.apache.org/docs/s2-031.html
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-3082
reference_id CVE-2016-3082
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-3082
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.20.3
purl pkg:maven/org.apache.struts/struts2-core@2.3.20.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-4bzw-ges2-d7ek
2
vulnerability VCID-7hxh-btrk-skhg
3
vulnerability VCID-7uv9-4vy7-ryd1
4
vulnerability VCID-8cmt-z8g9-duf2
5
vulnerability VCID-9mn7-d2mm-uqay
6
vulnerability VCID-cv6j-98vx-n3ed
7
vulnerability VCID-dbzr-zyeu-73g8
8
vulnerability VCID-dj42-wym9-nbhv
9
vulnerability VCID-fwkj-x53j-yqd8
10
vulnerability VCID-gvwn-8r4r-47gm
11
vulnerability VCID-jzbz-jpe1-cycg
12
vulnerability VCID-mmth-7rgf-aqfa
13
vulnerability VCID-mvdz-exud-3ybz
14
vulnerability VCID-nm42-xrpq-7ued
15
vulnerability VCID-npge-yn8z-6fac
16
vulnerability VCID-nztp-y8p8-cqc6
17
vulnerability VCID-pdny-erzd-jqhc
18
vulnerability VCID-q2ad-khtm-nqdr
19
vulnerability VCID-qdsq-8td3-5qa1
20
vulnerability VCID-renj-v5ce-2khx
21
vulnerability VCID-vztu-pap6-37ev
22
vulnerability VCID-wzez-6cmp-n7gn
23
vulnerability VCID-xgnf-d44x-kfc9
24
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.20.3
1
url pkg:maven/org.apache.struts/struts2-core@2.3.24.3
purl pkg:maven/org.apache.struts/struts2-core@2.3.24.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-4bzw-ges2-d7ek
2
vulnerability VCID-7hxh-btrk-skhg
3
vulnerability VCID-7uv9-4vy7-ryd1
4
vulnerability VCID-8cmt-z8g9-duf2
5
vulnerability VCID-cv6j-98vx-n3ed
6
vulnerability VCID-dbzr-zyeu-73g8
7
vulnerability VCID-dj42-wym9-nbhv
8
vulnerability VCID-dvxu-9sh6-qbef
9
vulnerability VCID-gvwn-8r4r-47gm
10
vulnerability VCID-hrky-nmnv-g3eu
11
vulnerability VCID-jzbz-jpe1-cycg
12
vulnerability VCID-mmth-7rgf-aqfa
13
vulnerability VCID-mvdz-exud-3ybz
14
vulnerability VCID-nm42-xrpq-7ued
15
vulnerability VCID-npge-yn8z-6fac
16
vulnerability VCID-nztp-y8p8-cqc6
17
vulnerability VCID-pdny-erzd-jqhc
18
vulnerability VCID-qdsq-8td3-5qa1
19
vulnerability VCID-renj-v5ce-2khx
20
vulnerability VCID-vztu-pap6-37ev
21
vulnerability VCID-wzez-6cmp-n7gn
22
vulnerability VCID-xgnf-d44x-kfc9
23
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.24.3
2
url pkg:maven/org.apache.struts/struts2-core@2.3.28.1
purl pkg:maven/org.apache.struts/struts2-core@2.3.28.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4bm7-hbe1-mfca
1
vulnerability VCID-4bzw-ges2-d7ek
2
vulnerability VCID-7hxh-btrk-skhg
3
vulnerability VCID-7uv9-4vy7-ryd1
4
vulnerability VCID-8cmt-z8g9-duf2
5
vulnerability VCID-cv6j-98vx-n3ed
6
vulnerability VCID-dbzr-zyeu-73g8
7
vulnerability VCID-dj42-wym9-nbhv
8
vulnerability VCID-dvxu-9sh6-qbef
9
vulnerability VCID-gvwn-8r4r-47gm
10
vulnerability VCID-hrky-nmnv-g3eu
11
vulnerability VCID-jzbz-jpe1-cycg
12
vulnerability VCID-mmth-7rgf-aqfa
13
vulnerability VCID-mvdz-exud-3ybz
14
vulnerability VCID-nm42-xrpq-7ued
15
vulnerability VCID-npge-yn8z-6fac
16
vulnerability VCID-nztp-y8p8-cqc6
17
vulnerability VCID-qdsq-8td3-5qa1
18
vulnerability VCID-renj-v5ce-2khx
19
vulnerability VCID-vztu-pap6-37ev
20
vulnerability VCID-wzez-6cmp-n7gn
21
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.28.1
aliases CVE-2016-3082, GHSA-pvm9-288c-v5wq
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-z1jy-4da2-tyhk
41
url VCID-z6wr-3psx-dbfm
vulnerability_id VCID-z6wr-3psx-dbfm
summary This package enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
references
0
reference_url http://archives.neohapsis.com/archives/bugtraq/2013-09/0107.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://archives.neohapsis.com/archives/bugtraq/2013-09/0107.html
1
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-4316.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-4316.json
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-4316
reference_id
reference_type
scores
0
value 0.06168
scoring_system epss
scoring_elements 0.91004
published_at 2026-06-05T12:55:00Z
1
value 0.06168
scoring_system epss
scoring_elements 0.90991
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-4316
3
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
4
reference_url https://github.com/apache/struts/commit/58947c3f85ae641c1a476316a2888e53605948d1
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/58947c3f85ae641c1a476316a2888e53605948d1
5
reference_url https://github.com/apache/struts/commit/c643336945dda84cbcdc8a39530baa24fede28c4
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/c643336945dda84cbcdc8a39530baa24fede28c4
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-4316
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-4316
7
reference_url http://struts.apache.org/docs/s2-019.html
reference_id
reference_type
scores
url http://struts.apache.org/docs/s2-019.html
8
reference_url http://struts.apache.org/release/2.3.x/docs/s2-019.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://struts.apache.org/release/2.3.x/docs/s2-019.html
9
reference_url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4316
reference_id
reference_type
scores
url https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4316
10
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1013036
reference_id 1013036
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1013036
11
reference_url https://github.com/advisories/GHSA-j7h6-xr7g-m2c5
reference_id GHSA-j7h6-xr7g-m2c5
reference_type
scores
url https://github.com/advisories/GHSA-j7h6-xr7g-m2c5
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.15.2
purl pkg:maven/org.apache.struts/struts2-core@2.3.15.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1uv2-rvmy-53hk
1
vulnerability VCID-4bm7-hbe1-mfca
2
vulnerability VCID-4bzw-ges2-d7ek
3
vulnerability VCID-4ywn-n1my-83ev
4
vulnerability VCID-7hxh-btrk-skhg
5
vulnerability VCID-7uv9-4vy7-ryd1
6
vulnerability VCID-84ge-vq7u-j3ar
7
vulnerability VCID-8cmt-z8g9-duf2
8
vulnerability VCID-8jup-umjw-9ba4
9
vulnerability VCID-9mn7-d2mm-uqay
10
vulnerability VCID-cv6j-98vx-n3ed
11
vulnerability VCID-dbzr-zyeu-73g8
12
vulnerability VCID-dj42-wym9-nbhv
13
vulnerability VCID-dvxu-9sh6-qbef
14
vulnerability VCID-fvde-37ch-z7cg
15
vulnerability VCID-fwkj-x53j-yqd8
16
vulnerability VCID-ghqg-ae1b-w7br
17
vulnerability VCID-gvwn-8r4r-47gm
18
vulnerability VCID-hrky-nmnv-g3eu
19
vulnerability VCID-jzbz-jpe1-cycg
20
vulnerability VCID-kmqa-hsqy-muf1
21
vulnerability VCID-m39c-3bv2-6ugy
22
vulnerability VCID-mmth-7rgf-aqfa
23
vulnerability VCID-mvdz-exud-3ybz
24
vulnerability VCID-nm42-xrpq-7ued
25
vulnerability VCID-npge-yn8z-6fac
26
vulnerability VCID-nztp-y8p8-cqc6
27
vulnerability VCID-pdny-erzd-jqhc
28
vulnerability VCID-q2ad-khtm-nqdr
29
vulnerability VCID-renj-v5ce-2khx
30
vulnerability VCID-t1s3-f181-tqca
31
vulnerability VCID-vztu-pap6-37ev
32
vulnerability VCID-wtca-5ffw-w7bc
33
vulnerability VCID-wzez-6cmp-n7gn
34
vulnerability VCID-xgnf-d44x-kfc9
35
vulnerability VCID-z1jy-4da2-tyhk
36
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.15.2
aliases CVE-2013-4316, GHSA-j7h6-xr7g-m2c5
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-z6wr-3psx-dbfm
42
url VCID-z9v1-pwvn-2bcy
vulnerability_id VCID-z9v1-pwvn-2bcy
summary 
Apache Struts file upload logic is flawed
File upload logic is flawed vulnerability in Apache Struts. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.

This issue affects Apache Struts: from 2.0.0 before 6.4.0.

Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload. If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.

You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067 .
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-53677.json
reference_id
reference_type
scores
0
value 9.0
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-53677.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-53677
reference_id
reference_type
scores
0
value 0.93188
scoring_system epss
scoring_elements 0.99807
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-53677
2
reference_url https://cwiki.apache.org/confluence/display/WW/S2-067
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:C/RE:L/U:Red
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-12-12T15:19:19Z/
url https://cwiki.apache.org/confluence/display/WW/S2-067
3
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
4
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:C/RE:L/U:Red
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
5
reference_url https://github.com/apache/struts/commit/1ecfbae46543a83e131404f8dcc84b3d0d554854
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:C/RE:L/U:Red
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/1ecfbae46543a83e131404f8dcc84b3d0d554854
6
reference_url https://github.com/apache/struts/commit/3ef9ade8902a63bb560892453eeca02bfddefc78
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:C/RE:L/U:Red
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/3ef9ade8902a63bb560892453eeca02bfddefc78
7
reference_url https://github.com/apache/struts/commit/930fef7679d7247db9e460c146b1698a9d7ad1e4
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:C/RE:L/U:Red
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/930fef7679d7247db9e460c146b1698a9d7ad1e4
8
reference_url https://security.netapp.com/advisory/ntap-20250103-0005
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:C/RE:L/U:Red
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20250103-0005
9
reference_url https://struts.apache.org/core-developers/file-upload
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:C/RE:L/U:Red
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://struts.apache.org/core-developers/file-upload
10
reference_url https://www.dynatrace.com/news/blog/the-anatomy-of-broken-apache-struts-2-a-technical-deep-dive-into-cve-2024-53677
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:C/RE:L/U:Red
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.dynatrace.com/news/blog/the-anatomy-of-broken-apache-struts-2-a-technical-deep-dive-into-cve-2024-53677
11
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2331686
reference_id 2331686
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2331686
12
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-53677
reference_id CVE-2024-53677
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:A/V:C/RE:L/U:Red
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-53677
13
reference_url https://github.com/advisories/GHSA-43mq-6xmg-29vm
reference_id GHSA-43mq-6xmg-29vm
reference_type
scores
url https://github.com/advisories/GHSA-43mq-6xmg-29vm
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@6.4.0
purl pkg:maven/org.apache.struts/struts2-core@6.4.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-gvwn-8r4r-47gm
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@6.4.0
aliases CVE-2024-53677, GHSA-43mq-6xmg-29vm
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-z9v1-pwvn-2bcy
Fixing_vulnerabilities
0
url VCID-4x3k-a11x-7bee
vulnerability_id VCID-4x3k-a11x-7bee
summary 
Remote command execution due to flaw in the includeParams attribute of URL and Anchor tags
This package allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the `includeParams` attribute in the URL or A tag.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-1966.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-1966.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-1966
reference_id
reference_type
scores
0
value 0.91096
scoring_system epss
scoring_elements 0.9966
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-1966
2
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=967656
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=967656
3
reference_url https://cwiki.apache.org/confluence/display/WW/S2-013
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://cwiki.apache.org/confluence/display/WW/S2-013
4
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
5
reference_url https://github.com/apache/struts/commit/7e6f641ebb142663cbd1653dc49bed725edf7f56
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/7e6f641ebb142663cbd1653dc49bed725edf7f56
6
reference_url http://struts.apache.org/development/2.x/docs/s2-013.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url http://struts.apache.org/development/2.x/docs/s2-013.html
7
reference_url http://struts.apache.org/docs/s2-013.html
reference_id
reference_type
scores
url http://struts.apache.org/docs/s2-013.html
8
reference_url http://struts.apache.org/docs/s2-014.html
reference_id
reference_type
scores
url http://struts.apache.org/docs/s2-014.html
9
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-1966
reference_id CVE-2013-1966
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-1966
10
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/25980.rb
reference_id CVE-2013-2115;OSVDB-93645;CVE-2013-1966
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/25980.rb
11
reference_url https://github.com/advisories/GHSA-737w-mh58-cxjp
reference_id GHSA-737w-mh58-cxjp
reference_type
scores
url https://github.com/advisories/GHSA-737w-mh58-cxjp
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.14.2
purl pkg:maven/org.apache.struts/struts2-core@2.3.14.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1exe-1vfk-f7bn
1
vulnerability VCID-1kjb-use6-23eu
2
vulnerability VCID-1uv2-rvmy-53hk
3
vulnerability VCID-447s-4ag7-gyes
4
vulnerability VCID-4bm7-hbe1-mfca
5
vulnerability VCID-4bzw-ges2-d7ek
6
vulnerability VCID-4ywn-n1my-83ev
7
vulnerability VCID-7hxh-btrk-skhg
8
vulnerability VCID-7uv9-4vy7-ryd1
9
vulnerability VCID-84ge-vq7u-j3ar
10
vulnerability VCID-89az-256b-mubw
11
vulnerability VCID-8cmt-z8g9-duf2
12
vulnerability VCID-8jup-umjw-9ba4
13
vulnerability VCID-9mn7-d2mm-uqay
14
vulnerability VCID-cv6j-98vx-n3ed
15
vulnerability VCID-dbzr-zyeu-73g8
16
vulnerability VCID-dj42-wym9-nbhv
17
vulnerability VCID-dvxu-9sh6-qbef
18
vulnerability VCID-fvde-37ch-z7cg
19
vulnerability VCID-fwkj-x53j-yqd8
20
vulnerability VCID-ghqg-ae1b-w7br
21
vulnerability VCID-gvwn-8r4r-47gm
22
vulnerability VCID-hrky-nmnv-g3eu
23
vulnerability VCID-jzbz-jpe1-cycg
24
vulnerability VCID-kmqa-hsqy-muf1
25
vulnerability VCID-m39c-3bv2-6ugy
26
vulnerability VCID-mmth-7rgf-aqfa
27
vulnerability VCID-mvdz-exud-3ybz
28
vulnerability VCID-nm42-xrpq-7ued
29
vulnerability VCID-npge-yn8z-6fac
30
vulnerability VCID-nztp-y8p8-cqc6
31
vulnerability VCID-pdny-erzd-jqhc
32
vulnerability VCID-q2ad-khtm-nqdr
33
vulnerability VCID-renj-v5ce-2khx
34
vulnerability VCID-t1s3-f181-tqca
35
vulnerability VCID-vztu-pap6-37ev
36
vulnerability VCID-wtca-5ffw-w7bc
37
vulnerability VCID-wzez-6cmp-n7gn
38
vulnerability VCID-xgnf-d44x-kfc9
39
vulnerability VCID-xpa5-fsb6-ukay
40
vulnerability VCID-z1jy-4da2-tyhk
41
vulnerability VCID-z6wr-3psx-dbfm
42
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.14.2
aliases CVE-2013-1966, GHSA-737w-mh58-cxjp
risk_score 10.0
exploitability 2.0
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4x3k-a11x-7bee
1
url VCID-wsvw-qwt7-qbg1
vulnerability_id VCID-wsvw-qwt7-qbg1
summary 
Remote command execution due to flaw in the includeParams attribute of URL and Anchor tags
This package allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the URL or A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-2115.json
reference_id
reference_type
scores
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-2115.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2013-2115
reference_id
reference_type
scores
0
value 0.8761
scoring_system epss
scoring_elements 0.99482
published_at 2026-06-05T12:55:00Z
1
value 0.8761
scoring_system epss
scoring_elements 0.99481
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2013-2115
2
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=967656
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=967656
3
reference_url https://cwiki.apache.org/confluence/display/WW/S2-013
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://cwiki.apache.org/confluence/display/WW/S2-013
4
reference_url https://cwiki.apache.org/confluence/display/WW/S2-014
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://cwiki.apache.org/confluence/display/WW/S2-014
5
reference_url https://github.com/apache/struts
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts
6
reference_url https://github.com/apache/struts/commit/d7804297e319c7a12245e1b536e565fcea6d650
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/d7804297e319c7a12245e1b536e565fcea6d650
7
reference_url https://github.com/apache/struts/commit/d934c6e7430b7b98e43a0a085a2304bd31a75c3d
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/d934c6e7430b7b98e43a0a085a2304bd31a75c3d
8
reference_url https://github.com/apache/struts/commit/ea96d18d0f75c390d2595648efa3563785c272c6
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/ea96d18d0f75c390d2595648efa3563785c272c6
9
reference_url https://github.com/apache/struts/commit/fed4f8e8a4ec69b5e7612b92d8ce3e476680474
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/struts/commit/fed4f8e8a4ec69b5e7612b92d8ce3e476680474
10
reference_url https://issues.apache.org/jira/browse/WW-4063
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://issues.apache.org/jira/browse/WW-4063
11
reference_url http://struts.apache.org/development/2.x/docs/s2-014.html
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://struts.apache.org/development/2.x/docs/s2-014.html
12
reference_url http://struts.apache.org/docs/s2-014.html
reference_id
reference_type
scores
url http://struts.apache.org/docs/s2-014.html
13
reference_url https://web.archive.org/web/20140212000331/http://www.securityfocus.com/bid/60167
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://web.archive.org/web/20140212000331/http://www.securityfocus.com/bid/60167
14
reference_url https://nvd.nist.gov/vuln/detail/CVE-2013-2115
reference_id CVE-2013-2115
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2013-2115
15
reference_url https://github.com/advisories/GHSA-7ghm-rpc7-p7g5
reference_id GHSA-7ghm-rpc7-p7g5
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-7ghm-rpc7-p7g5
fixed_packages
0
url pkg:maven/org.apache.struts/struts2-core@2.3.14.2
purl pkg:maven/org.apache.struts/struts2-core@2.3.14.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1exe-1vfk-f7bn
1
vulnerability VCID-1kjb-use6-23eu
2
vulnerability VCID-1uv2-rvmy-53hk
3
vulnerability VCID-447s-4ag7-gyes
4
vulnerability VCID-4bm7-hbe1-mfca
5
vulnerability VCID-4bzw-ges2-d7ek
6
vulnerability VCID-4ywn-n1my-83ev
7
vulnerability VCID-7hxh-btrk-skhg
8
vulnerability VCID-7uv9-4vy7-ryd1
9
vulnerability VCID-84ge-vq7u-j3ar
10
vulnerability VCID-89az-256b-mubw
11
vulnerability VCID-8cmt-z8g9-duf2
12
vulnerability VCID-8jup-umjw-9ba4
13
vulnerability VCID-9mn7-d2mm-uqay
14
vulnerability VCID-cv6j-98vx-n3ed
15
vulnerability VCID-dbzr-zyeu-73g8
16
vulnerability VCID-dj42-wym9-nbhv
17
vulnerability VCID-dvxu-9sh6-qbef
18
vulnerability VCID-fvde-37ch-z7cg
19
vulnerability VCID-fwkj-x53j-yqd8
20
vulnerability VCID-ghqg-ae1b-w7br
21
vulnerability VCID-gvwn-8r4r-47gm
22
vulnerability VCID-hrky-nmnv-g3eu
23
vulnerability VCID-jzbz-jpe1-cycg
24
vulnerability VCID-kmqa-hsqy-muf1
25
vulnerability VCID-m39c-3bv2-6ugy
26
vulnerability VCID-mmth-7rgf-aqfa
27
vulnerability VCID-mvdz-exud-3ybz
28
vulnerability VCID-nm42-xrpq-7ued
29
vulnerability VCID-npge-yn8z-6fac
30
vulnerability VCID-nztp-y8p8-cqc6
31
vulnerability VCID-pdny-erzd-jqhc
32
vulnerability VCID-q2ad-khtm-nqdr
33
vulnerability VCID-renj-v5ce-2khx
34
vulnerability VCID-t1s3-f181-tqca
35
vulnerability VCID-vztu-pap6-37ev
36
vulnerability VCID-wtca-5ffw-w7bc
37
vulnerability VCID-wzez-6cmp-n7gn
38
vulnerability VCID-xgnf-d44x-kfc9
39
vulnerability VCID-xpa5-fsb6-ukay
40
vulnerability VCID-z1jy-4da2-tyhk
41
vulnerability VCID-z6wr-3psx-dbfm
42
vulnerability VCID-z9v1-pwvn-2bcy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.14.2
aliases CVE-2013-2115, GHSA-7ghm-rpc7-p7g5
risk_score 10.0
exploitability 2.0
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wsvw-qwt7-qbg1
Risk_score10.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.14.2