Search for packages
| purl | pkg:maven/org.apache.struts.xwork/xwork-core@2.3.20 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-js22-usgt-8qd9
Aliases: CVE-2016-4430 GHSA-38qw-j787-v8c2 |
Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors. |
Affected by 1 other vulnerability. |
|
VCID-p9xh-frm5-8ucp
Aliases: CVE-2015-1831 GHSA-q2cg-xf9p-h457 |
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. |
Affected by 3 other vulnerabilities. |
|
VCID-tgd1-s1yg-9fdt
Aliases: CVE-2025-68493 GHSA-qcfc-hmrc-59x7 |
Apache Struts 2 is Missing XML Validation Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue. | There are no reported fixed by versions. |
|
VCID-zc1y-ff37-nqat
Aliases: CVE-2016-4433 GHSA-wm8w-qp2f-728q |
Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-ufcq-57q9-53c7 | The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself. |
CVE-2012-0394
GHSA-hmvj-gc9q-mg9p |