VulnerableCode Package Details - pkg:maven/struts/struts@1.2.9

Search for packages

Vulnerability	Summary	Fixed by
VCID-4wwa-j9p2-9be1 Aliases: CVE-2008-2025 GHSA-wcgx-2hvx-5cwr	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "insufficient quoting of parameters."	1.2.9-162.31.1 Affected by 0 other vulnerabilities.
VCID-dk2f-14xj-9bf8 Aliases: CVE-2023-34396 GHSA-4g42-gqrg-4633	Apache Struts vulnerable to memory exhaustion Denial of service via out of memory (OOM) owing to no sanity limit on normal form fields in multipart forms. When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings without checking their sizes. This could lead to an OOM if developer has set struts.multipart.maxSize to a value equal or greater than the available memory. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater	There are no reported fixed by versions.
VCID-g2gb-x2nh-2bgz Aliases: CVE-2012-1007 GHSA-9848-v244-962p	Cross-site Scripting Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to `struts-examples/upload/upload-submit.do`, or the message parameter to (2) `struts-cookbook/processSimple.do` or (3) `struts-cookbook/processDyna.do`.	There are no reported fixed by versions.
VCID-jjre-tuhb-4yat Aliases: CVE-2023-49735 GHSA-qw4h-3xjj-84cc	Apache Tiles: Unvalidated input may lead to path traversal and XXE The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles. This issue affects Apache Tiles from version 2 onwards. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.	There are no reported fixed by versions.
VCID-nur4-1g8a-57ew Aliases: CVE-2014-0114 GHSA-p66x-2cv9-qq3v	Improper Input Validation Apache Commons BeanUtils does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the `ActionForm` object in Struts	There are no reported fixed by versions.
VCID-ppuk-knqn-tfc6 Aliases: CVE-2016-1182 GHSA-5ggr-mpgw-3mgx	ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.	There are no reported fixed by versions.
VCID-s3uq-35pj-byhy Aliases: CVE-2015-0899 GHSA-cvvx-r33m-v7pq	The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.	There are no reported fixed by versions.
VCID-vk8c-a1za-w3cd Aliases: CVE-2025-54656 GHSA-cx25-xg7c-xfm5	Apache Struts Extras Before 2 has an Improper Output Neutralization for Logs Vulnerability UNSUPPORTED WHEN ASSIGNED Improper Output Neutralization for Logs vulnerability in Apache Struts. This issue affects Apache Struts Extras: before 2. When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output where part of the message masquerades as a separate log line, confusing consumers of the logs (either human or automated). As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.	There are no reported fixed by versions.
VCID-wqjz-93pk-pbg7 Aliases: CVE-2016-1181 GHSA-7jw3-5q4w-89qg	ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-4wwa-j9p2-9be1
Aliases:
CVE-2008-2025
GHSA-wcgx-2hvx-5cwr

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "insufficient quoting of parameters."

1.2.9-162.31.1
Affected by 0 other vulnerabilities.

VCID-dk2f-14xj-9bf8
Aliases:
CVE-2023-34396
GHSA-4g42-gqrg-4633

Apache Struts vulnerable to memory exhaustion Denial of service via out of memory (OOM) owing to no sanity limit on normal form fields in multipart forms. When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings without checking their sizes. This could lead to an OOM if developer has set struts.multipart.maxSize to a value equal or greater than the available memory. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater