{"url":"http://public2.vulnerablecode.io/api/packages/19977?format=json","purl":"pkg:maven/org.apache.struts/struts2-core@2-alpha0","type":"maven","namespace":"org.apache.struts","name":"struts2-core","version":"2-alpha0","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"6.8.0","latest_non_vulnerable_version":"7.1.1","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/4582?format=json","vulnerability_id":"VCID-6241-shkt-s7ew","summary":"Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2134","reference_id":"","reference_type":"","scores":[{"value":"0.91526","scoring_system":"epss","scoring_elements":"0.99672","published_at":"2026-04-13T12:55:00Z"},{"value":"0.91526","scoring_system":"epss","scoring_elements":"0.99683","published_at":"2026-05-14T12:55:00Z"},{"value":"0.91526","scoring_system":"epss","scoring_elements":"0.99681","published_at":"2026-05-12T12:55:00Z"},{"value":"0.91526","scoring_system":"epss","scoring_elements":"0.9968","published_at":"2026-05-09T12:55:00Z"},{"value":"0.91526","scoring_system":"epss","scoring_elements":"0.99679","published_at":"2026-05-07T12:55:00Z"},{"value":"0.91526","scoring_system":"epss","scoring_elements":"0.99678","published_at":"2026-05-05T12:55:00Z"},{"value":"0.91526","scoring_system":"epss","scoring_elements":"0.99677","published_at":"2026-04-29T12:55:00Z"},{"value":"0.91526","scoring_system":"epss","scoring_elements":"0.99675","published_at":"2026-04-21T12:55:00Z"},{"value":"0.91526","scoring_system":"epss","scoring_elements":"0.99674","published_at":"2026-04-18T12:55:00Z"},{"value":"0.91526","scoring_system":"epss","scoring_elements":"0.99671","published_at":"2026-04-09T12:55:00Z"},{"value":"0.91526","scoring_system":"epss","scoring_elements":"0.99673","published_at":"2026-04-16T12:55:00Z"},{"value":"0.92052","scoring_system":"epss","scoring_elements":"0.99699","published_at":"2026-04-02T12:55:00Z"},{"value":"0.92052","scoring_system":"epss","scoring_elements":"0.99701","published_at":"2026-04-07T12:55:00Z"},{"value":"0.92052","scoring_system":"epss","scoring_elements":"0.997","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2134"},{"reference_url":"https://cwiki.apache.org/confluence/display/WW/S2-015","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://cwiki.apache.org/confluence/display/WW/S2-015"},{"reference_url":"http://security.gentoo.org/glsa/glsa-201409-04.xml","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://security.gentoo.org/glsa/glsa-201409-04.xml"},{"reference_url":"https://github.com/apache/struts","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts"},{"reference_url":"https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e"},{"reference_url":"https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e0","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e0"},{"reference_url":"https://github.com/apache/struts/commit/041206d2a693d02c0cb2e72765275e55ba14049f","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/041206d2a693d02c0cb2e72765275e55ba14049f"},{"reference_url":"https://github.com/apache/struts/commit/113c47082c09818bcef65acc436a2d0c7c47aa6c","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/113c47082c09818bcef65acc436a2d0c7c47aa6c"},{"reference_url":"https://github.com/apache/struts/commit/54e5c912ebd9a1599bfcf7a719da17c28127bbe","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/struts/commit/54e5c912ebd9a1599bfcf7a719da17c28127bbe"},{"reference_url":"https://github.com/apache/struts/commit/54e5c912ebd9a1599bfcf7a719da17c28127bbe3","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/54e5c912ebd9a1599bfcf7a719da17c28127bbe3"},{"reference_url":"https://github.com/apache/struts/commit/711cf0201cdd319a38cf29238913312355db29ba","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/711cf0201cdd319a38cf29238913312355db29ba"},{"reference_url":"https://github.com/apache/struts/commit/8b4fc81daeea3834bcbf73de5f48d0021917aa3","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/struts/commit/8b4fc81daeea3834bcbf73de5f48d0021917aa3"},{"reference_url":"https://github.com/apache/struts/commit/8b4fc81daeea3834bcbf73de5f48d0021917aa37","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/8b4fc81daeea3834bcbf73de5f48d0021917aa37"},{"reference_url":"https://github.com/apache/struts/commit/cfb6e9afbae320a4dd5bdd655154ab9fe5a92c1","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/struts/commit/cfb6e9afbae320a4dd5bdd655154ab9fe5a92c1"},{"reference_url":"https://github.com/apache/struts/commit/cfb6e9afbae320a4dd5bdd655154ab9fe5a92c16","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/cfb6e9afbae320a4dd5bdd655154ab9fe5a92c16"},{"reference_url":"https://issues.apache.org/jira/browse/WW-4090","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://issues.apache.org/jira/browse/WW-4090"},{"reference_url":"https://issues.apache.org/jira/browse/WW-4094","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://issues.apache.org/jira/browse/WW-4094"},{"reference_url":"https://issues.apache.org/jira/browse/WW-4095","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://issues.apache.org/jira/browse/WW-4095"},{"reference_url":"http://struts.apache.org/development/2.x/docs/s2-015.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://struts.apache.org/development/2.x/docs/s2-015.html"},{"reference_url":"http://struts.apache.org/docs/s2-015.html","reference_id":"","reference_type":"","scores":[],"url":"http://struts.apache.org/docs/s2-015.html"},{"reference_url":"https://web.archive.org/web/20140226173351/http://www.securityfocus.com/bid/60346","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20140226173351/http://www.securityfocus.com/bid/60346"},{"reference_url":"https://web.archive.org/web/20140410223942/http://www.securityfocus.com/bid/64758","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20140410223942/http://www.securityfocus.com/bid/64758"},{"reference_url":"http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"},{"reference_url":"http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html"},{"reference_url":"http://www.securityfocus.com/bid/60346","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/60346"},{"reference_url":"http://www.securityfocus.com/bid/64758","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/64758"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2134","reference_id":"CVE-2013-2134","reference_type":"","scores":[{"value":"9.3","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:C/I:C/A:C"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2134"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/38549.txt","reference_id":"CVE-2013-2134;OSVDB-93969","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/38549.txt"},{"reference_url":"https://www.securityfocus.com/bid/60345/info","reference_id":"CVE-2013-2134;OSVDB-93969","reference_type":"exploit","scores":[],"url":"https://www.securityfocus.com/bid/60345/info"},{"reference_url":"https://github.com/advisories/GHSA-gqqm-564f-vvxq","reference_id":"GHSA-gqqm-564f-vvxq","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gqqm-564f-vvxq"},{"reference_url":"https://security.gentoo.org/glsa/201409-04","reference_id":"GLSA-201409-04","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201409-04"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20324?format=json","purl":"pkg:maven/org.apache.struts/struts2-core@2.3.14.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2chz-36wn-9fcv"},{"vulnerability":"VCID-2rjv-1thm-dugt"},{"vulnerability":"VCID-2v7h-fght-cugn"},{"vulnerability":"VCID-3yq7-n972-j7dh"},{"vulnerability":"VCID-4agy-6nsx-7ufh"},{"vulnerability":"VCID-579w-2k2v-efa2"},{"vulnerability":"VCID-6hrc-fm64-ckhf"},{"vulnerability":"VCID-6t1x-s2k2-b7bq"},{"vulnerability":"VCID-74ab-1p1c-4qbd"},{"vulnerability":"VCID-759g-hsfg-97f8"},{"vulnerability":"VCID-79j9-v8gz-rfax"},{"vulnerability":"VCID-7c97-nj5a-hqb8"},{"vulnerability":"VCID-87fh-rvvb-6ubq"},{"vulnerability":"VCID-8bsh-bshc-vkgq"},{"vulnerability":"VCID-8mws-fbmg-cqa9"},{"vulnerability":"VCID-95ts-vpk6-uubg"},{"vulnerability":"VCID-at5c-f8p8-67fh"},{"vulnerability":"VCID-b59n-uxft-4qgz"},{"vulnerability":"VCID-b7zy-qhz9-tuar"},{"vulnerability":"VCID-bgbt-j1n9-6yg5"},{"vulnerability":"VCID-cm62-bsdz-yye2"},{"vulnerability":"VCID-dk2f-14xj-9bf8"},{"vulnerability":"VCID-gfxq-vtry-bqgg"},{"vulnerability":"VCID-h4yg-zrv6-aqa1"},{"vulnerability":"VCID-hgj2-vqzn-gyeb"},{"vulnerability":"VCID-j5su-cnqd-6yad"},{"vulnerability":"VCID-kdsa-599r-eud7"},{"vulnerability":"VCID-mdde-pa5h-w7g4"},{"vulnerability":"VCID-me84-wy85-hkf5"},{"vulnerability":"VCID-n2dn-bnjc-13gp"},{"vulnerability":"VCID-qqm4-frqy-bua5"},{"vulnerability":"VCID-tcaj-6bcg-k7g2"},{"vulnerability":"VCID-tgd1-s1yg-9fdt"},{"vulnerability":"VCID-vgp6-jxqt-pbf4"},{"vulnerability":"VCID-xz41-1z86-37ew"},{"vulnerability":"VCID-y4qu-21c9-6fav"},{"vulnerability":"VCID-y5uq-a6dx-3yd4"},{"vulnerability":"VCID-ygbu-vb2t-jqhx"},{"vulnerability":"VCID-zb3c-gnyc-yug8"},{"vulnerability":"VCID-zxww-8kb3-tufv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.14.3"}],"aliases":["CVE-2013-2134","GHSA-gqqm-564f-vvxq"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"8.4","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6241-shkt-s7ew"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5126?format=json","vulnerability_id":"VCID-6t1x-s2k2-b7bq","summary":"Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-4310.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-4310.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2013-4310","reference_id":"","reference_type":"","scores":[{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.92575","published_at":"2026-05-14T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.92519","published_at":"2026-05-05T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.92529","published_at":"2026-05-07T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.9254","published_at":"2026-05-09T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.92544","published_at":"2026-05-11T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.9255","published_at":"2026-05-12T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.92456","published_at":"2026-04-01T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.92462","published_at":"2026-04-02T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.92471","published_at":"2026-04-04T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.92474","published_at":"2026-04-07T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.92485","published_at":"2026-04-08T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.9249","published_at":"2026-04-09T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.92496","published_at":"2026-04-13T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.92498","published_at":"2026-04-12T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.92507","published_at":"2026-04-16T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.92506","published_at":"2026-04-18T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.9251","published_at":"2026-04-21T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.92512","published_at":"2026-04-24T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.92513","published_at":"2026-04-26T12:55:00Z"},{"value":"0.08725","scoring_system":"epss","scoring_elements":"0.92509","published_at":"2026-04-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2013-4310"},{"reference_url":"https://github.com/apache/struts","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts"},{"reference_url":"https://github.com/apache/struts/commit/0c8366cb792227d484b9ca13e537037dd0cb57dc","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/0c8366cb792227d484b9ca13e537037dd0cb57dc"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4310","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4310"},{"reference_url":"http://struts.apache.org/docs/s2-018.html","reference_id":"","reference_type":"","scores":[],"url":"http://struts.apache.org/docs/s2-018.html"},{"reference_url":"http://struts.apache.org/release/2.3.x/docs/s2-018.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://struts.apache.org/release/2.3.x/docs/s2-018.html"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1013030","reference_id":"1013030","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1013030"},{"reference_url":"https://github.com/advisories/GHSA-q5q8-jghf-3pm3","reference_id":"GHSA-q5q8-jghf-3pm3","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-q5q8-jghf-3pm3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20432?format=json","purl":"pkg:maven/org.apache.struts/struts2-core@2.3.15.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2chz-36wn-9fcv"},{"vulnerability":"VCID-2rjv-1thm-dugt"},{"vulnerability":"VCID-2v7h-fght-cugn"},{"vulnerability":"VCID-3yq7-n972-j7dh"},{"vulnerability":"VCID-4agy-6nsx-7ufh"},{"vulnerability":"VCID-579w-2k2v-efa2"},{"vulnerability":"VCID-6hrc-fm64-ckhf"},{"vulnerability":"VCID-74ab-1p1c-4qbd"},{"vulnerability":"VCID-79j9-v8gz-rfax"},{"vulnerability":"VCID-7c97-nj5a-hqb8"},{"vulnerability":"VCID-87fh-rvvb-6ubq"},{"vulnerability":"VCID-8bsh-bshc-vkgq"},{"vulnerability":"VCID-8mws-fbmg-cqa9"},{"vulnerability":"VCID-95ts-vpk6-uubg"},{"vulnerability":"VCID-at5c-f8p8-67fh"},{"vulnerability":"VCID-b7zy-qhz9-tuar"},{"vulnerability":"VCID-bgbt-j1n9-6yg5"},{"vulnerability":"VCID-cm62-bsdz-yye2"},{"vulnerability":"VCID-dk2f-14xj-9bf8"},{"vulnerability":"VCID-gfxq-vtry-bqgg"},{"vulnerability":"VCID-h4yg-zrv6-aqa1"},{"vulnerability":"VCID-hgj2-vqzn-gyeb"},{"vulnerability":"VCID-j5su-cnqd-6yad"},{"vulnerability":"VCID-kdsa-599r-eud7"},{"vulnerability":"VCID-mdde-pa5h-w7g4"},{"vulnerability":"VCID-me84-wy85-hkf5"},{"vulnerability":"VCID-n2dn-bnjc-13gp"},{"vulnerability":"VCID-qqm4-frqy-bua5"},{"vulnerability":"VCID-tcaj-6bcg-k7g2"},{"vulnerability":"VCID-tgd1-s1yg-9fdt"},{"vulnerability":"VCID-vgp6-jxqt-pbf4"},{"vulnerability":"VCID-y4qu-21c9-6fav"},{"vulnerability":"VCID-y5uq-a6dx-3yd4"},{"vulnerability":"VCID-ygbu-vb2t-jqhx"},{"vulnerability":"VCID-zb3c-gnyc-yug8"},{"vulnerability":"VCID-zxww-8kb3-tufv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.15.3"}],"aliases":["CVE-2013-4310","GHSA-q5q8-jghf-3pm3"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6t1x-s2k2-b7bq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/4579?format=json","vulnerability_id":"VCID-759g-hsfg-97f8","summary":"Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2248","reference_id":"","reference_type":"","scores":[{"value":"0.91954","scoring_system":"epss","scoring_elements":"0.99709","published_at":"2026-05-14T12:55:00Z"},{"value":"0.91954","scoring_system":"epss","scoring_elements":"0.99697","published_at":"2026-04-16T12:55:00Z"},{"value":"0.91954","scoring_system":"epss","scoring_elements":"0.99698","published_at":"2026-04-18T12:55:00Z"},{"value":"0.91954","scoring_system":"epss","scoring_elements":"0.997","published_at":"2026-04-21T12:55:00Z"},{"value":"0.91954","scoring_system":"epss","scoring_elements":"0.99702","published_at":"2026-04-26T12:55:00Z"},{"value":"0.91954","scoring_system":"epss","scoring_elements":"0.99703","published_at":"2026-04-29T12:55:00Z"},{"value":"0.91954","scoring_system":"epss","scoring_elements":"0.99704","published_at":"2026-05-05T12:55:00Z"},{"value":"0.91954","scoring_system":"epss","scoring_elements":"0.99705","published_at":"2026-05-09T12:55:00Z"},{"value":"0.91954","scoring_system":"epss","scoring_elements":"0.99706","published_at":"2026-05-12T12:55:00Z"},{"value":"0.91954","scoring_system":"epss","scoring_elements":"0.99692","published_at":"2026-04-02T12:55:00Z"},{"value":"0.91954","scoring_system":"epss","scoring_elements":"0.99693","published_at":"2026-04-04T12:55:00Z"},{"value":"0.91954","scoring_system":"epss","scoring_elements":"0.99694","published_at":"2026-04-07T12:55:00Z"},{"value":"0.91954","scoring_system":"epss","scoring_elements":"0.99695","published_at":"2026-04-09T12:55:00Z"},{"value":"0.91954","scoring_system":"epss","scoring_elements":"0.99696","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2248"},{"reference_url":"https://github.com/apache/struts","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts"},{"reference_url":"https://github.com/apache/struts/commit/3cfe34fefedcf0fdcfcb061c0aea34a715b7de6","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/3cfe34fefedcf0fdcfcb061c0aea34a715b7de6"},{"reference_url":"https://github.com/apache/struts/commit/630e1ba065a8215c4e9ac03bfb09be9d655c2b6e","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/630e1ba065a8215c4e9ac03bfb09be9d655c2b6e"},{"reference_url":"https://issues.apache.org/jira/browse/WW-4140","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://issues.apache.org/jira/browse/WW-4140"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2248","reference_id":"","reference_type":"","scores":[{"value":"5.8","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:P/I:P/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2248"},{"reference_url":"http://struts.apache.org/docs/s2-017.html","reference_id":"","reference_type":"","scores":[],"url":"http://struts.apache.org/docs/s2-017.html"},{"reference_url":"http://struts.apache.org/release/2.3.x/docs/s2-017.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://struts.apache.org/release/2.3.x/docs/s2-017.html"},{"reference_url":"http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html","reference_id":"","reference_type":"","scores":[],"url":"http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html"},{"reference_url":"http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html","reference_id":"","reference_type":"","scores":[],"url":"http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"},{"reference_url":"http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html","reference_id":"","reference_type":"","scores":[],"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html"},{"reference_url":"http://www.securityfocus.com/bid/61196","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/61196"},{"reference_url":"http://www.securityfocus.com/bid/64758","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/64758"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/38666.txt","reference_id":"CVE-2013-2248;OSVDB-95406","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/38666.txt"},{"reference_url":"https://www.securityfocus.com/bid/61196/info","reference_id":"CVE-2013-2248;OSVDB-95406","reference_type":"exploit","scores":[],"url":"https://www.securityfocus.com/bid/61196/info"},{"reference_url":"https://github.com/advisories/GHSA-rpj9-r897-wc6q","reference_id":"GHSA-rpj9-r897-wc6q","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rpj9-r897-wc6q"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20328?format=json","purl":"pkg:maven/org.apache.struts/struts2-core@2.3.15.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2chz-36wn-9fcv"},{"vulnerability":"VCID-2rjv-1thm-dugt"},{"vulnerability":"VCID-2v7h-fght-cugn"},{"vulnerability":"VCID-3yq7-n972-j7dh"},{"vulnerability":"VCID-4agy-6nsx-7ufh"},{"vulnerability":"VCID-579w-2k2v-efa2"},{"vulnerability":"VCID-6hrc-fm64-ckhf"},{"vulnerability":"VCID-6t1x-s2k2-b7bq"},{"vulnerability":"VCID-74ab-1p1c-4qbd"},{"vulnerability":"VCID-79j9-v8gz-rfax"},{"vulnerability":"VCID-7c97-nj5a-hqb8"},{"vulnerability":"VCID-87fh-rvvb-6ubq"},{"vulnerability":"VCID-8bsh-bshc-vkgq"},{"vulnerability":"VCID-8mws-fbmg-cqa9"},{"vulnerability":"VCID-95ts-vpk6-uubg"},{"vulnerability":"VCID-at5c-f8p8-67fh"},{"vulnerability":"VCID-b59n-uxft-4qgz"},{"vulnerability":"VCID-b7zy-qhz9-tuar"},{"vulnerability":"VCID-bgbt-j1n9-6yg5"},{"vulnerability":"VCID-cm62-bsdz-yye2"},{"vulnerability":"VCID-dk2f-14xj-9bf8"},{"vulnerability":"VCID-gfxq-vtry-bqgg"},{"vulnerability":"VCID-h4yg-zrv6-aqa1"},{"vulnerability":"VCID-hgj2-vqzn-gyeb"},{"vulnerability":"VCID-j5su-cnqd-6yad"},{"vulnerability":"VCID-kdsa-599r-eud7"},{"vulnerability":"VCID-mdde-pa5h-w7g4"},{"vulnerability":"VCID-me84-wy85-hkf5"},{"vulnerability":"VCID-n2dn-bnjc-13gp"},{"vulnerability":"VCID-qqm4-frqy-bua5"},{"vulnerability":"VCID-tcaj-6bcg-k7g2"},{"vulnerability":"VCID-tgd1-s1yg-9fdt"},{"vulnerability":"VCID-vgp6-jxqt-pbf4"},{"vulnerability":"VCID-y4qu-21c9-6fav"},{"vulnerability":"VCID-y5uq-a6dx-3yd4"},{"vulnerability":"VCID-ygbu-vb2t-jqhx"},{"vulnerability":"VCID-zb3c-gnyc-yug8"},{"vulnerability":"VCID-zxww-8kb3-tufv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.15.1"}],"aliases":["CVE-2013-2248","GHSA-rpj9-r897-wc6q"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-759g-hsfg-97f8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/4712?format=json","vulnerability_id":"VCID-b59n-uxft-4qgz","summary":"Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.","references":[{"reference_url":"http://archives.neohapsis.com/archives/bugtraq/2013-09/0107.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://archives.neohapsis.com/archives/bugtraq/2013-09/0107.html"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-4316.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-4316.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2013-4316","reference_id":"","reference_type":"","scores":[{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.90928","published_at":"2026-05-14T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.90866","published_at":"2026-04-29T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.90881","published_at":"2026-05-05T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.90899","published_at":"2026-05-07T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.9091","published_at":"2026-05-09T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.90908","published_at":"2026-05-11T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.90917","published_at":"2026-05-12T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.90784","published_at":"2026-04-01T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.90789","published_at":"2026-04-02T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.90801","published_at":"2026-04-04T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.90812","published_at":"2026-04-07T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.90823","published_at":"2026-04-08T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.90829","published_at":"2026-04-09T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.90838","published_at":"2026-04-12T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.90836","published_at":"2026-04-13T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.9086","published_at":"2026-04-16T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.90858","published_at":"2026-04-18T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.90856","published_at":"2026-04-21T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.9087","published_at":"2026-04-24T12:55:00Z"},{"value":"0.06168","scoring_system":"epss","scoring_elements":"0.90868","published_at":"2026-04-26T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2013-4316"},{"reference_url":"https://github.com/apache/struts","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts"},{"reference_url":"https://github.com/apache/struts/commit/58947c3f85ae641c1a476316a2888e53605948d1","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/58947c3f85ae641c1a476316a2888e53605948d1"},{"reference_url":"https://github.com/apache/struts/commit/c643336945dda84cbcdc8a39530baa24fede28c4","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/c643336945dda84cbcdc8a39530baa24fede28c4"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4316","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4316"},{"reference_url":"http://struts.apache.org/docs/s2-019.html","reference_id":"","reference_type":"","scores":[],"url":"http://struts.apache.org/docs/s2-019.html"},{"reference_url":"http://struts.apache.org/release/2.3.x/docs/s2-019.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://struts.apache.org/release/2.3.x/docs/s2-019.html"},{"reference_url":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4316","reference_id":"","reference_type":"","scores":[],"url":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4316"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1013036","reference_id":"1013036","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1013036"},{"reference_url":"https://github.com/advisories/GHSA-j7h6-xr7g-m2c5","reference_id":"GHSA-j7h6-xr7g-m2c5","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-j7h6-xr7g-m2c5"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20431?format=json","purl":"pkg:maven/org.apache.struts/struts2-core@2.3.15.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2chz-36wn-9fcv"},{"vulnerability":"VCID-2rjv-1thm-dugt"},{"vulnerability":"VCID-2v7h-fght-cugn"},{"vulnerability":"VCID-3yq7-n972-j7dh"},{"vulnerability":"VCID-4agy-6nsx-7ufh"},{"vulnerability":"VCID-579w-2k2v-efa2"},{"vulnerability":"VCID-6hrc-fm64-ckhf"},{"vulnerability":"VCID-6t1x-s2k2-b7bq"},{"vulnerability":"VCID-74ab-1p1c-4qbd"},{"vulnerability":"VCID-79j9-v8gz-rfax"},{"vulnerability":"VCID-7c97-nj5a-hqb8"},{"vulnerability":"VCID-87fh-rvvb-6ubq"},{"vulnerability":"VCID-8bsh-bshc-vkgq"},{"vulnerability":"VCID-8mws-fbmg-cqa9"},{"vulnerability":"VCID-95ts-vpk6-uubg"},{"vulnerability":"VCID-at5c-f8p8-67fh"},{"vulnerability":"VCID-b7zy-qhz9-tuar"},{"vulnerability":"VCID-bgbt-j1n9-6yg5"},{"vulnerability":"VCID-cm62-bsdz-yye2"},{"vulnerability":"VCID-dk2f-14xj-9bf8"},{"vulnerability":"VCID-gfxq-vtry-bqgg"},{"vulnerability":"VCID-h4yg-zrv6-aqa1"},{"vulnerability":"VCID-hgj2-vqzn-gyeb"},{"vulnerability":"VCID-j5su-cnqd-6yad"},{"vulnerability":"VCID-kdsa-599r-eud7"},{"vulnerability":"VCID-mdde-pa5h-w7g4"},{"vulnerability":"VCID-me84-wy85-hkf5"},{"vulnerability":"VCID-n2dn-bnjc-13gp"},{"vulnerability":"VCID-qqm4-frqy-bua5"},{"vulnerability":"VCID-tcaj-6bcg-k7g2"},{"vulnerability":"VCID-tgd1-s1yg-9fdt"},{"vulnerability":"VCID-vgp6-jxqt-pbf4"},{"vulnerability":"VCID-y4qu-21c9-6fav"},{"vulnerability":"VCID-y5uq-a6dx-3yd4"},{"vulnerability":"VCID-ygbu-vb2t-jqhx"},{"vulnerability":"VCID-zb3c-gnyc-yug8"},{"vulnerability":"VCID-zxww-8kb3-tufv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.15.2"}],"aliases":["CVE-2013-4316","GHSA-j7h6-xr7g-m2c5"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-b59n-uxft-4qgz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6686?format=json","vulnerability_id":"VCID-evh9-mua1-2bem","summary":"XWork ParameterInterceptors bypass allows remote command execution\nThe OGNL extensive expression evaluation capability in this package as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive allowlist, which allows remote attackers to modify server-side context objects and bypass the \"#\" protection mechanism in ParameterInterceptors via the `#context`, `#_memberAccess`, `#root`, `#this`, `#_typeResolver`, `#_classResolver`, `#_traceEvaluations`, `#_lastEvaluation`, `#_keepLastEvaluation`, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.","references":[{"reference_url":"http://blog.o0o.nu/2010/07/cve-2010-1870-struts2xwork-remote.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://blog.o0o.nu/2010/07/cve-2010-1870-struts2xwork-remote.html"},{"reference_url":"http://confluence.atlassian.com/display/FISHEYE/FishEye+Security+Advisory+2010-06-16","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://confluence.atlassian.com/display/FISHEYE/FishEye+Security+Advisory+2010-06-16"},{"reference_url":"http://packetstormsecurity.com/files/159643/LISTSERV-Maestro-9.0-8-Remote-Code-Execution.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://packetstormsecurity.com/files/159643/LISTSERV-Maestro-9.0-8-Remote-Code-Execution.html"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2010-1870.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2010-1870.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2010-1870","reference_id":"","reference_type":"","scores":[{"value":"0.92533","scoring_system":"epss","scoring_elements":"0.99746","published_at":"2026-05-14T12:55:00Z"},{"value":"0.92533","scoring_system":"epss","scoring_elements":"0.99735","published_at":"2026-04-02T12:55:00Z"},{"value":"0.92533","scoring_system":"epss","scoring_elements":"0.99736","published_at":"2026-04-04T12:55:00Z"},{"value":"0.92533","scoring_system":"epss","scoring_elements":"0.99738","published_at":"2026-04-13T12:55:00Z"},{"value":"0.92533","scoring_system":"epss","scoring_elements":"0.99739","published_at":"2026-04-18T12:55:00Z"},{"value":"0.92533","scoring_system":"epss","scoring_elements":"0.9974","published_at":"2026-04-21T12:55:00Z"},{"value":"0.92533","scoring_system":"epss","scoring_elements":"0.99742","published_at":"2026-04-24T12:55:00Z"},{"value":"0.92533","scoring_system":"epss","scoring_elements":"0.99743","published_at":"2026-04-29T12:55:00Z"},{"value":"0.92533","scoring_system":"epss","scoring_elements":"0.99744","published_at":"2026-05-09T12:55:00Z"},{"value":"0.92533","scoring_system":"epss","scoring_elements":"0.99745","published_at":"2026-05-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2010-1870"},{"reference_url":"https://cwiki.apache.org/confluence/display/WW/S2-003","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://cwiki.apache.org/confluence/display/WW/S2-003"},{"reference_url":"http://seclists.org/fulldisclosure/2010/Jul/183","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://seclists.org/fulldisclosure/2010/Jul/183"},{"reference_url":"http://seclists.org/fulldisclosure/2020/Oct/23","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://seclists.org/fulldisclosure/2020/Oct/23"},{"reference_url":"http://secunia.com/advisories/59110","reference_id":"","reference_type":"","scores":[],"url":"http://secunia.com/advisories/59110"},{"reference_url":"http://securityreason.com/securityalert/8345","reference_id":"","reference_type":"","scores":[],"url":"http://securityreason.com/securityalert/8345"},{"reference_url":"https://github.com/apache/struts","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1870","reference_id":"","reference_type":"","scores":[{"value":"5.0","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:L/Au:N/C:N/I:P/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1870"},{"reference_url":"http://struts.apache.org/2.2.1/docs/s2-005.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://struts.apache.org/2.2.1/docs/s2-005.html"},{"reference_url":"http://struts.apache.org/docs/s2-005.html","reference_id":"","reference_type":"","scores":[],"url":"http://struts.apache.org/docs/s2-005.html"},{"reference_url":"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140709-struts2","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140709-struts2"},{"reference_url":"http://www.exploit-db.com/exploits/14360","reference_id":"","reference_type":"","scores":[],"url":"http://www.exploit-db.com/exploits/14360"},{"reference_url":"http://www.osvdb.org/66280","reference_id":"","reference_type":"","scores":[],"url":"http://www.osvdb.org/66280"},{"reference_url":"http://www.securityfocus.com/bid/41592","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/41592"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1123727","reference_id":"1123727","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1123727"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/14360.txt","reference_id":"CVE-2010-1870;OSVDB-66280","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/14360.txt"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/17691.rb","reference_id":"CVE-2010-1870;OSVDB-66280","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/17691.rb"},{"reference_url":"https://github.com/advisories/GHSA-x5fc-pgpx-59j5","reference_id":"GHSA-x5fc-pgpx-59j5","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-x5fc-pgpx-59j5"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/19979?format=json","purl":"pkg:maven/org.apache.struts/struts2-core@2.2.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2chz-36wn-9fcv"},{"vulnerability":"VCID-2rjv-1thm-dugt"},{"vulnerability":"VCID-2v7h-fght-cugn"},{"vulnerability":"VCID-3yq7-n972-j7dh"},{"vulnerability":"VCID-4agy-6nsx-7ufh"},{"vulnerability":"VCID-579w-2k2v-efa2"},{"vulnerability":"VCID-6241-shkt-s7ew"},{"vulnerability":"VCID-6hrc-fm64-ckhf"},{"vulnerability":"VCID-6t1x-s2k2-b7bq"},{"vulnerability":"VCID-759g-hsfg-97f8"},{"vulnerability":"VCID-79j9-v8gz-rfax"},{"vulnerability":"VCID-87fh-rvvb-6ubq"},{"vulnerability":"VCID-8bsh-bshc-vkgq"},{"vulnerability":"VCID-8mws-fbmg-cqa9"},{"vulnerability":"VCID-95ts-vpk6-uubg"},{"vulnerability":"VCID-at5c-f8p8-67fh"},{"vulnerability":"VCID-b59n-uxft-4qgz"},{"vulnerability":"VCID-b7zy-qhz9-tuar"},{"vulnerability":"VCID-bgbt-j1n9-6yg5"},{"vulnerability":"VCID-cm62-bsdz-yye2"},{"vulnerability":"VCID-dk2f-14xj-9bf8"},{"vulnerability":"VCID-fv6w-cdtc-kkhx"},{"vulnerability":"VCID-gfxq-vtry-bqgg"},{"vulnerability":"VCID-gv5f-auvz-5fda"},{"vulnerability":"VCID-h4yg-zrv6-aqa1"},{"vulnerability":"VCID-hgj2-vqzn-gyeb"},{"vulnerability":"VCID-hkjh-35ye-1ugj"},{"vulnerability":"VCID-j5su-cnqd-6yad"},{"vulnerability":"VCID-k6mz-k1yb-4uej"},{"vulnerability":"VCID-kdsa-599r-eud7"},{"vulnerability":"VCID-me84-wy85-hkf5"},{"vulnerability":"VCID-n2dn-bnjc-13gp"},{"vulnerability":"VCID-n4fb-crnk-eugz"},{"vulnerability":"VCID-nmgp-r7hb-5ke1"},{"vulnerability":"VCID-q96z-v3bs-k3dg"},{"vulnerability":"VCID-qqm4-frqy-bua5"},{"vulnerability":"VCID-r28t-sdc5-kbga"},{"vulnerability":"VCID-tcaj-6bcg-k7g2"},{"vulnerability":"VCID-tgd1-s1yg-9fdt"},{"vulnerability":"VCID-vgp6-jxqt-pbf4"},{"vulnerability":"VCID-vkb9-11h4-dugp"},{"vulnerability":"VCID-vnkw-9fa2-zqcm"},{"vulnerability":"VCID-x65e-31g3-77bp"},{"vulnerability":"VCID-xz41-1z86-37ew"},{"vulnerability":"VCID-y5uq-a6dx-3yd4"},{"vulnerability":"VCID-ygbu-vb2t-jqhx"},{"vulnerability":"VCID-z1gf-169n-m3af"},{"vulnerability":"VCID-zb3c-gnyc-yug8"},{"vulnerability":"VCID-zxww-8kb3-tufv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.2.1"}],"aliases":["CVE-2010-1870","GHSA-x5fc-pgpx-59j5"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-evh9-mua1-2bem"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/52039?format=json","vulnerability_id":"VCID-fv6w-cdtc-kkhx","summary":"Struts ParameterInterceptor vulnerability allows remote command execution\nRegular expression in ParametersInterceptor matches `top['foo'](0)` as a valid expression, which OGNL treats as `(top['foo'])(0)` and evaluates the value of 'foo' action parameter as an OGNL expression. This lets malicious users put arbitrary OGNL statements into any String variable exposed by an action and have it evaluated as an OGNL expression and since OGNL statement is in HTTP parameter value attacker can use blacklisted characters (e.g. #) to disable method execution and execute arbitrary methods, bypassing the ParametersInterceptor and OGNL library protections.","references":[{"reference_url":"http://blog.o0o.nu/2012/01/cve-2011-3923-yet-another-struts2.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://blog.o0o.nu/2012/01/cve-2011-3923-yet-another-struts2.html"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2011-3923","reference_id":"","reference_type":"","scores":[{"value":"0.91054","scoring_system":"epss","scoring_elements":"0.99637","published_at":"2026-04-02T12:55:00Z"},{"value":"0.91054","scoring_system":"epss","scoring_elements":"0.99651","published_at":"2026-05-14T12:55:00Z"},{"value":"0.91054","scoring_system":"epss","scoring_elements":"0.99643","published_at":"2026-04-21T12:55:00Z"},{"value":"0.91054","scoring_system":"epss","scoring_elements":"0.99638","published_at":"2026-04-04T12:55:00Z"},{"value":"0.91054","scoring_system":"epss","scoring_elements":"0.99641","published_at":"2026-04-16T12:55:00Z"},{"value":"0.91054","scoring_system":"epss","scoring_elements":"0.9964","published_at":"2026-04-13T12:55:00Z"},{"value":"0.91054","scoring_system":"epss","scoring_elements":"0.99649","published_at":"2026-05-12T12:55:00Z"},{"value":"0.91054","scoring_system":"epss","scoring_elements":"0.99648","published_at":"2026-05-11T12:55:00Z"},{"value":"0.91054","scoring_system":"epss","scoring_elements":"0.99647","published_at":"2026-05-05T12:55:00Z"},{"value":"0.91054","scoring_system":"epss","scoring_elements":"0.99646","published_at":"2026-04-29T12:55:00Z"},{"value":"0.91054","scoring_system":"epss","scoring_elements":"0.99645","published_at":"2026-04-26T12:55:00Z"},{"value":"0.91054","scoring_system":"epss","scoring_elements":"0.99644","published_at":"2026-04-24T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2011-3923"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3923","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3923"},{"reference_url":"http://seclists.org/fulldisclosure/2014/Jul/38","reference_id":"","reference_type":"","scores":[],"url":"http://seclists.org/fulldisclosure/2014/Jul/38"},{"reference_url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/72585","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/72585"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2011-3923","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:L/Au:N/C:P/I:P/A:P"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-3923"},{"reference_url":"https://security-tracker.debian.org/tracker/CVE-2011-3923","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security-tracker.debian.org/tracker/CVE-2011-3923"},{"reference_url":"http://struts.apache.org/development/2.x/docs/s2-009.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://struts.apache.org/development/2.x/docs/s2-009.html"},{"reference_url":"http://struts.apache.org/docs/s2-009.html","reference_id":"","reference_type":"","scores":[],"url":"http://struts.apache.org/docs/s2-009.html"},{"reference_url":"https://web.archive.org/web/20140725074137/http://seclists.org/fulldisclosure/2014/Jul/38","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20140725074137/http://seclists.org/fulldisclosure/2014/Jul/38"},{"reference_url":"http://www.exploit-db.com/exploits/24874","reference_id":"","reference_type":"","scores":[],"url":"http://www.exploit-db.com/exploits/24874"},{"reference_url":"http://www.securityfocus.com/bid/51628","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/51628"},{"reference_url":"http://www.securitytracker.com/id?1026575","reference_id":"","reference_type":"","scores":[],"url":"http://www.securitytracker.com/id?1026575"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:jboss_enterprise_web_server:1.0.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:redhat:jboss_enterprise_web_server:1.0.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:jboss_enterprise_web_server:1.0.0:*:*:*:*:*:*:*"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/24874.rb","reference_id":"CVE-2011-3923;OSVDB-78501","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/24874.rb"},{"reference_url":"https://github.com/advisories/GHSA-j68f-8h6p-9h5q","reference_id":"GHSA-j68f-8h6p-9h5q","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-j68f-8h6p-9h5q"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22233?format=json","purl":"pkg:maven/org.apache.struts/struts2-core@2.3.1.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2chz-36wn-9fcv"},{"vulnerability":"VCID-2rjv-1thm-dugt"},{"vulnerability":"VCID-2v7h-fght-cugn"},{"vulnerability":"VCID-3yq7-n972-j7dh"},{"vulnerability":"VCID-4agy-6nsx-7ufh"},{"vulnerability":"VCID-579w-2k2v-efa2"},{"vulnerability":"VCID-6241-shkt-s7ew"},{"vulnerability":"VCID-6hrc-fm64-ckhf"},{"vulnerability":"VCID-6t1x-s2k2-b7bq"},{"vulnerability":"VCID-74ab-1p1c-4qbd"},{"vulnerability":"VCID-759g-hsfg-97f8"},{"vulnerability":"VCID-79j9-v8gz-rfax"},{"vulnerability":"VCID-7c97-nj5a-hqb8"},{"vulnerability":"VCID-87fh-rvvb-6ubq"},{"vulnerability":"VCID-8bsh-bshc-vkgq"},{"vulnerability":"VCID-8mws-fbmg-cqa9"},{"vulnerability":"VCID-95ts-vpk6-uubg"},{"vulnerability":"VCID-at5c-f8p8-67fh"},{"vulnerability":"VCID-b59n-uxft-4qgz"},{"vulnerability":"VCID-b7zy-qhz9-tuar"},{"vulnerability":"VCID-bgbt-j1n9-6yg5"},{"vulnerability":"VCID-cm62-bsdz-yye2"},{"vulnerability":"VCID-dk2f-14xj-9bf8"},{"vulnerability":"VCID-gfxq-vtry-bqgg"},{"vulnerability":"VCID-h4yg-zrv6-aqa1"},{"vulnerability":"VCID-hgj2-vqzn-gyeb"},{"vulnerability":"VCID-hkjh-35ye-1ugj"},{"vulnerability":"VCID-j5su-cnqd-6yad"},{"vulnerability":"VCID-k6mz-k1yb-4uej"},{"vulnerability":"VCID-kdsa-599r-eud7"},{"vulnerability":"VCID-me84-wy85-hkf5"},{"vulnerability":"VCID-n2dn-bnjc-13gp"},{"vulnerability":"VCID-n4fb-crnk-eugz"},{"vulnerability":"VCID-q96z-v3bs-k3dg"},{"vulnerability":"VCID-qqm4-frqy-bua5"},{"vulnerability":"VCID-tcaj-6bcg-k7g2"},{"vulnerability":"VCID-tgd1-s1yg-9fdt"},{"vulnerability":"VCID-vgp6-jxqt-pbf4"},{"vulnerability":"VCID-vkb9-11h4-dugp"},{"vulnerability":"VCID-vnkw-9fa2-zqcm"},{"vulnerability":"VCID-xz41-1z86-37ew"},{"vulnerability":"VCID-y5uq-a6dx-3yd4"},{"vulnerability":"VCID-ygbu-vb2t-jqhx"},{"vulnerability":"VCID-zb3c-gnyc-yug8"},{"vulnerability":"VCID-zxww-8kb3-tufv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.1.2"}],"aliases":["CVE-2011-3923","GHSA-j68f-8h6p-9h5q"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-fv6w-cdtc-kkhx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/4752?format=json","vulnerability_id":"VCID-hkjh-35ye-1ugj","summary":"Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-2115.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-2115.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2115","reference_id":"","reference_type":"","scores":[{"value":"0.87487","scoring_system":"epss","scoring_elements":"0.99454","published_at":"2026-04-01T12:55:00Z"},{"value":"0.8761","scoring_system":"epss","scoring_elements":"0.99475","published_at":"2026-05-14T12:55:00Z"},{"value":"0.8761","scoring_system":"epss","scoring_elements":"0.99476","published_at":"2026-05-12T12:55:00Z"},{"value":"0.8761","scoring_system":"epss","scoring_elements":"0.99457","published_at":"2026-04-02T12:55:00Z"},{"value":"0.8761","scoring_system":"epss","scoring_elements":"0.99473","published_at":"2026-05-07T12:55:00Z"},{"value":"0.8761","scoring_system":"epss","scoring_elements":"0.99472","published_at":"2026-05-09T12:55:00Z"},{"value":"0.8761","scoring_system":"epss","scoring_elements":"0.99471","published_at":"2026-04-24T12:55:00Z"},{"value":"0.8761","scoring_system":"epss","scoring_elements":"0.99469","published_at":"2026-04-21T12:55:00Z"},{"value":"0.8761","scoring_system":"epss","scoring_elements":"0.99468","published_at":"2026-04-16T12:55:00Z"},{"value":"0.8761","scoring_system":"epss","scoring_elements":"0.99465","published_at":"2026-04-13T12:55:00Z"},{"value":"0.8761","scoring_system":"epss","scoring_elements":"0.99464","published_at":"2026-04-11T12:55:00Z"},{"value":"0.8761","scoring_system":"epss","scoring_elements":"0.99463","published_at":"2026-04-09T12:55:00Z"},{"value":"0.8761","scoring_system":"epss","scoring_elements":"0.99462","published_at":"2026-04-08T12:55:00Z"},{"value":"0.8761","scoring_system":"epss","scoring_elements":"0.99461","published_at":"2026-04-07T12:55:00Z"},{"value":"0.8761","scoring_system":"epss","scoring_elements":"0.99459","published_at":"2026-04-04T12:55:00Z"},{"value":"0.8761","scoring_system":"epss","scoring_elements":"0.99474","published_at":"2026-05-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2115"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=967656","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=967656"},{"reference_url":"https://cwiki.apache.org/confluence/display/WW/S2-013","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://cwiki.apache.org/confluence/display/WW/S2-013"},{"reference_url":"https://cwiki.apache.org/confluence/display/WW/S2-014","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://cwiki.apache.org/confluence/display/WW/S2-014"},{"reference_url":"https://github.com/apache/struts","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts"},{"reference_url":"https://github.com/apache/struts/commit/d7804297e319c7a12245e1b536e565fcea6d650","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/d7804297e319c7a12245e1b536e565fcea6d650"},{"reference_url":"https://github.com/apache/struts/commit/d934c6e7430b7b98e43a0a085a2304bd31a75c3d","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/d934c6e7430b7b98e43a0a085a2304bd31a75c3d"},{"reference_url":"https://github.com/apache/struts/commit/ea96d18d0f75c390d2595648efa3563785c272c6","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/ea96d18d0f75c390d2595648efa3563785c272c6"},{"reference_url":"https://github.com/apache/struts/commit/fed4f8e8a4ec69b5e7612b92d8ce3e476680474","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/fed4f8e8a4ec69b5e7612b92d8ce3e476680474"},{"reference_url":"https://issues.apache.org/jira/browse/WW-4063","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://issues.apache.org/jira/browse/WW-4063"},{"reference_url":"http://struts.apache.org/development/2.x/docs/s2-014.html","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://struts.apache.org/development/2.x/docs/s2-014.html"},{"reference_url":"http://struts.apache.org/docs/s2-014.html","reference_id":"","reference_type":"","scores":[],"url":"http://struts.apache.org/docs/s2-014.html"},{"reference_url":"https://web.archive.org/web/20140212000331/http://www.securityfocus.com/bid/60167","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20140212000331/http://www.securityfocus.com/bid/60167"},{"reference_url":"http://www.securityfocus.com/bid/60167","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/60167"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2115","reference_id":"CVE-2013-2115","reference_type":"","scores":[{"value":"9.3","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:C/I:C/A:C"},{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2115"},{"reference_url":"https://github.com/advisories/GHSA-7ghm-rpc7-p7g5","reference_id":"GHSA-7ghm-rpc7-p7g5","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7ghm-rpc7-p7g5"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20314?format=json","purl":"pkg:maven/org.apache.struts/struts2-core@2.3.14.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2chz-36wn-9fcv"},{"vulnerability":"VCID-2rjv-1thm-dugt"},{"vulnerability":"VCID-2v7h-fght-cugn"},{"vulnerability":"VCID-3yq7-n972-j7dh"},{"vulnerability":"VCID-4agy-6nsx-7ufh"},{"vulnerability":"VCID-579w-2k2v-efa2"},{"vulnerability":"VCID-6241-shkt-s7ew"},{"vulnerability":"VCID-6hrc-fm64-ckhf"},{"vulnerability":"VCID-6t1x-s2k2-b7bq"},{"vulnerability":"VCID-74ab-1p1c-4qbd"},{"vulnerability":"VCID-759g-hsfg-97f8"},{"vulnerability":"VCID-79j9-v8gz-rfax"},{"vulnerability":"VCID-7c97-nj5a-hqb8"},{"vulnerability":"VCID-87fh-rvvb-6ubq"},{"vulnerability":"VCID-8bsh-bshc-vkgq"},{"vulnerability":"VCID-8mws-fbmg-cqa9"},{"vulnerability":"VCID-95ts-vpk6-uubg"},{"vulnerability":"VCID-at5c-f8p8-67fh"},{"vulnerability":"VCID-b59n-uxft-4qgz"},{"vulnerability":"VCID-b7zy-qhz9-tuar"},{"vulnerability":"VCID-bgbt-j1n9-6yg5"},{"vulnerability":"VCID-cm62-bsdz-yye2"},{"vulnerability":"VCID-dk2f-14xj-9bf8"},{"vulnerability":"VCID-gfxq-vtry-bqgg"},{"vulnerability":"VCID-h4yg-zrv6-aqa1"},{"vulnerability":"VCID-hgj2-vqzn-gyeb"},{"vulnerability":"VCID-j5su-cnqd-6yad"},{"vulnerability":"VCID-kdsa-599r-eud7"},{"vulnerability":"VCID-mdde-pa5h-w7g4"},{"vulnerability":"VCID-me84-wy85-hkf5"},{"vulnerability":"VCID-n2dn-bnjc-13gp"},{"vulnerability":"VCID-n4fb-crnk-eugz"},{"vulnerability":"VCID-qqm4-frqy-bua5"},{"vulnerability":"VCID-tcaj-6bcg-k7g2"},{"vulnerability":"VCID-tgd1-s1yg-9fdt"},{"vulnerability":"VCID-vgp6-jxqt-pbf4"},{"vulnerability":"VCID-vnkw-9fa2-zqcm"},{"vulnerability":"VCID-xz41-1z86-37ew"},{"vulnerability":"VCID-y4qu-21c9-6fav"},{"vulnerability":"VCID-y5uq-a6dx-3yd4"},{"vulnerability":"VCID-ygbu-vb2t-jqhx"},{"vulnerability":"VCID-zb3c-gnyc-yug8"},{"vulnerability":"VCID-zxww-8kb3-tufv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.14.2"}],"aliases":["CVE-2013-2115","GHSA-7ghm-rpc7-p7g5"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"8.4","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hkjh-35ye-1ugj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6747?format=json","vulnerability_id":"VCID-k6mz-k1yb-4uej","summary":"CSRF protection bypass\nThe token check mechanism in this package does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2012-4386","reference_id":"","reference_type":"","scores":[{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87217","published_at":"2026-05-14T12:55:00Z"},{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87096","published_at":"2026-04-18T12:55:00Z"},{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87111","published_at":"2026-04-24T12:55:00Z"},{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87117","published_at":"2026-04-29T12:55:00Z"},{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87138","published_at":"2026-05-05T12:55:00Z"},{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87153","published_at":"2026-05-07T12:55:00Z"},{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87171","published_at":"2026-05-09T12:55:00Z"},{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87166","published_at":"2026-05-11T12:55:00Z"},{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87182","published_at":"2026-05-12T12:55:00Z"},{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87022","published_at":"2026-04-01T12:55:00Z"},{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87033","published_at":"2026-04-02T12:55:00Z"},{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87052","published_at":"2026-04-04T12:55:00Z"},{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87045","published_at":"2026-04-07T12:55:00Z"},{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87065","published_at":"2026-04-08T12:55:00Z"},{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87073","published_at":"2026-04-09T12:55:00Z"},{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87086","published_at":"2026-04-11T12:55:00Z"},{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87081","published_at":"2026-04-12T12:55:00Z"},{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87076","published_at":"2026-04-13T12:55:00Z"},{"value":"0.03235","scoring_system":"epss","scoring_elements":"0.87092","published_at":"2026-04-21T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2012-4386"},{"reference_url":"http://secunia.com/advisories/50420","reference_id":"","reference_type":"","scores":[],"url":"http://secunia.com/advisories/50420"},{"reference_url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/78182","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/78182"},{"reference_url":"https://issues.apache.org/jira/browse/WW-3858","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://issues.apache.org/jira/browse/WW-3858"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4386","reference_id":"","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:P/I:P/A:P"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4386"},{"reference_url":"http://struts.apache.org/2.x/docs/s2-010.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://struts.apache.org/2.x/docs/s2-010.html"},{"reference_url":"http://struts.apache.org/docs/s2-010.html","reference_id":"","reference_type":"","scores":[],"url":"http://struts.apache.org/docs/s2-010.html"},{"reference_url":"http://www.openwall.com/lists/oss-security/2012/09/01/4","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2012/09/01/4"},{"reference_url":"http://www.openwall.com/lists/oss-security/2012/09/01/5","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2012/09/01/5"},{"reference_url":"http://www.securityfocus.com/bid/55346","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/55346"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*"},{"reference_url":"https://github.com/advisories/GHSA-2rvh-q539-q33v","reference_id":"GHSA-2rvh-q539-q33v","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-2rvh-q539-q33v"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20101?format=json","purl":"pkg:maven/org.apache.struts/struts2-core@2.3.4.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2chz-36wn-9fcv"},{"vulnerability":"VCID-2rjv-1thm-dugt"},{"vulnerability":"VCID-2v7h-fght-cugn"},{"vulnerability":"VCID-3yq7-n972-j7dh"},{"vulnerability":"VCID-4agy-6nsx-7ufh"},{"vulnerability":"VCID-579w-2k2v-efa2"},{"vulnerability":"VCID-6241-shkt-s7ew"},{"vulnerability":"VCID-6hrc-fm64-ckhf"},{"vulnerability":"VCID-6t1x-s2k2-b7bq"},{"vulnerability":"VCID-74ab-1p1c-4qbd"},{"vulnerability":"VCID-759g-hsfg-97f8"},{"vulnerability":"VCID-79j9-v8gz-rfax"},{"vulnerability":"VCID-7c97-nj5a-hqb8"},{"vulnerability":"VCID-87fh-rvvb-6ubq"},{"vulnerability":"VCID-8bsh-bshc-vkgq"},{"vulnerability":"VCID-8mws-fbmg-cqa9"},{"vulnerability":"VCID-95ts-vpk6-uubg"},{"vulnerability":"VCID-at5c-f8p8-67fh"},{"vulnerability":"VCID-b59n-uxft-4qgz"},{"vulnerability":"VCID-b7zy-qhz9-tuar"},{"vulnerability":"VCID-bgbt-j1n9-6yg5"},{"vulnerability":"VCID-cm62-bsdz-yye2"},{"vulnerability":"VCID-dk2f-14xj-9bf8"},{"vulnerability":"VCID-gfxq-vtry-bqgg"},{"vulnerability":"VCID-h4yg-zrv6-aqa1"},{"vulnerability":"VCID-hgj2-vqzn-gyeb"},{"vulnerability":"VCID-hkjh-35ye-1ugj"},{"vulnerability":"VCID-j5su-cnqd-6yad"},{"vulnerability":"VCID-kdsa-599r-eud7"},{"vulnerability":"VCID-me84-wy85-hkf5"},{"vulnerability":"VCID-n2dn-bnjc-13gp"},{"vulnerability":"VCID-n4fb-crnk-eugz"},{"vulnerability":"VCID-qqm4-frqy-bua5"},{"vulnerability":"VCID-tcaj-6bcg-k7g2"},{"vulnerability":"VCID-tgd1-s1yg-9fdt"},{"vulnerability":"VCID-vgp6-jxqt-pbf4"},{"vulnerability":"VCID-vkb9-11h4-dugp"},{"vulnerability":"VCID-vnkw-9fa2-zqcm"},{"vulnerability":"VCID-xz41-1z86-37ew"},{"vulnerability":"VCID-y5uq-a6dx-3yd4"},{"vulnerability":"VCID-ygbu-vb2t-jqhx"},{"vulnerability":"VCID-zb3c-gnyc-yug8"},{"vulnerability":"VCID-zxww-8kb3-tufv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.4.1"}],"aliases":["CVE-2012-4386","GHSA-2rvh-q539-q33v"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-k6mz-k1yb-4uej"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/4905?format=json","vulnerability_id":"VCID-kdsa-599r-eud7","summary":"The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to \"manipulate\" the ClassLoader via the class parameter, which is passed to the getClass method.","references":[{"reference_url":"http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2014-000045"},{"reference_url":"http://jvn.jp/en/jp/JVN19294237/index.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://jvn.jp/en/jp/JVN19294237/index.html"},{"reference_url":"http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0094.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0094.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2014-0094","reference_id":"","reference_type":"","scores":[{"value":"0.93134","scoring_system":"epss","scoring_elements":"0.99794","published_at":"2026-04-04T12:55:00Z"},{"value":"0.93134","scoring_system":"epss","scoring_elements":"0.99797","published_at":"2026-05-14T12:55:00Z"},{"value":"0.93134","scoring_system":"epss","scoring_elements":"0.99799","published_at":"2026-04-29T12:55:00Z"},{"value":"0.93134","scoring_system":"epss","scoring_elements":"0.99796","published_at":"2026-04-13T12:55:00Z"},{"value":"0.93134","scoring_system":"epss","scoring_elements":"0.99795","published_at":"2026-04-08T12:55:00Z"},{"value":"0.93134","scoring_system":"epss","scoring_elements":"0.99798","published_at":"2026-05-12T12:55:00Z"},{"value":"0.93239","scoring_system":"epss","scoring_elements":"0.99808","published_at":"2026-05-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2014-0094"},{"reference_url":"https://github.com/apache/struts","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts"},{"reference_url":"https://github.com/apache/struts/commit/2e2da292166adbc78c4cb1e308b30ddb4fba6d3f","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/2e2da292166adbc78c4cb1e308b30ddb4fba6d3f"},{"reference_url":"https://github.com/apache/struts/commit/6315241719be167542962da436b38782ed730c62","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/6315241719be167542962da436b38782ed730c62"},{"reference_url":"https://github.com/apache/struts/commit/74e26830d2849a84729b33497f729e0f033dc147","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/struts/commit/74e26830d2849a84729b33497f729e0f033dc147"},{"reference_url":"http://struts.apache.org/docs/s2-021.html","reference_id":"","reference_type":"","scores":[],"url":"http://struts.apache.org/docs/s2-021.html"},{"reference_url":"http://struts.apache.org/release/2.3.x/docs/s2-020.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://struts.apache.org/release/2.3.x/docs/s2-020.html"},{"reference_url":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0094","reference_id":"","reference_type":"","scores":[],"url":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0094"},{"reference_url":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0113","reference_id":"","reference_type":"","scores":[],"url":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0113"},{"reference_url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676706","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676706"},{"reference_url":"http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm"},{"reference_url":"http://www.konakart.com/downloads/ver-7-3-0-0-whats-new","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.konakart.com/downloads/ver-7-3-0-0-whats-new"},{"reference_url":"http://www.vmware.com/security/advisories/VMSA-2014-0007.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.vmware.com/security/advisories/VMSA-2014-0007.html"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1073716","reference_id":"1073716","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1073716"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0094","reference_id":"CVE-2014-0094","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0094"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/33142.rb","reference_id":"CVE-2014-0113;CVE-2014-0112;CVE-2014-0094;OSVDB-103918","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/33142.rb"},{"reference_url":"https://github.com/rapid7/metasploit-framework/blob/3123175ac75c38bec5165e01cda05e3b38287003/modules/exploits/multi/http/struts_code_exec_classloader.rb","reference_id":"CVE-2014-0114;CVE-2014-0112;CVE-2014-0094","reference_type":"exploit","scores":[],"url":"https://github.com/rapid7/metasploit-framework/blob/3123175ac75c38bec5165e01cda05e3b38287003/modules/exploits/multi/http/struts_code_exec_classloader.rb"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/41690.rb","reference_id":"CVE-2014-0114;CVE-2014-0112;CVE-2014-0094","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/41690.rb"},{"reference_url":"https://github.com/advisories/GHSA-vrwc-qjmw-5rjm","reference_id":"GHSA-vrwc-qjmw-5rjm","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vrwc-qjmw-5rjm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20586?format=json","purl":"pkg:maven/org.apache.struts/struts2-core@2.3.16.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2chz-36wn-9fcv"},{"vulnerability":"VCID-2rjv-1thm-dugt"},{"vulnerability":"VCID-2v7h-fght-cugn"},{"vulnerability":"VCID-3yq7-n972-j7dh"},{"vulnerability":"VCID-4agy-6nsx-7ufh"},{"vulnerability":"VCID-579w-2k2v-efa2"},{"vulnerability":"VCID-6hrc-fm64-ckhf"},{"vulnerability":"VCID-74ab-1p1c-4qbd"},{"vulnerability":"VCID-79j9-v8gz-rfax"},{"vulnerability":"VCID-7c97-nj5a-hqb8"},{"vulnerability":"VCID-87fh-rvvb-6ubq"},{"vulnerability":"VCID-8bsh-bshc-vkgq"},{"vulnerability":"VCID-8mws-fbmg-cqa9"},{"vulnerability":"VCID-95ts-vpk6-uubg"},{"vulnerability":"VCID-at5c-f8p8-67fh"},{"vulnerability":"VCID-b7zy-qhz9-tuar"},{"vulnerability":"VCID-bgbt-j1n9-6yg5"},{"vulnerability":"VCID-cm62-bsdz-yye2"},{"vulnerability":"VCID-dk2f-14xj-9bf8"},{"vulnerability":"VCID-gfxq-vtry-bqgg"},{"vulnerability":"VCID-hgj2-vqzn-gyeb"},{"vulnerability":"VCID-j5su-cnqd-6yad"},{"vulnerability":"VCID-mdde-pa5h-w7g4"},{"vulnerability":"VCID-me84-wy85-hkf5"},{"vulnerability":"VCID-tcaj-6bcg-k7g2"},{"vulnerability":"VCID-tgd1-s1yg-9fdt"},{"vulnerability":"VCID-vgp6-jxqt-pbf4"},{"vulnerability":"VCID-y4qu-21c9-6fav"},{"vulnerability":"VCID-y5uq-a6dx-3yd4"},{"vulnerability":"VCID-ygbu-vb2t-jqhx"},{"vulnerability":"VCID-zb3c-gnyc-yug8"},{"vulnerability":"VCID-zxww-8kb3-tufv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.16.2"}],"aliases":["CVE-2014-0094","GHSA-vrwc-qjmw-5rjm"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kdsa-599r-eud7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/4658?format=json","vulnerability_id":"VCID-q96z-v3bs-k3dg","summary":"Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2012-4387","reference_id":"","reference_type":"","scores":[{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.92111","published_at":"2026-05-14T12:55:00Z"},{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.92044","published_at":"2026-04-12T12:55:00Z"},{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.92059","published_at":"2026-04-16T12:55:00Z"},{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.92056","published_at":"2026-04-18T12:55:00Z"},{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.92054","published_at":"2026-04-21T12:55:00Z"},{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.92058","published_at":"2026-04-24T12:55:00Z"},{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.92057","published_at":"2026-04-26T12:55:00Z"},{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.92053","published_at":"2026-04-29T12:55:00Z"},{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.92064","published_at":"2026-05-05T12:55:00Z"},{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.92078","published_at":"2026-05-07T12:55:00Z"},{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.92086","published_at":"2026-05-11T12:55:00Z"},{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.92093","published_at":"2026-05-12T12:55:00Z"},{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.92003","published_at":"2026-04-01T12:55:00Z"},{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.92011","published_at":"2026-04-02T12:55:00Z"},{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.92019","published_at":"2026-04-04T12:55:00Z"},{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.92024","published_at":"2026-04-07T12:55:00Z"},{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.92037","published_at":"2026-04-08T12:55:00Z"},{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.9204","published_at":"2026-04-13T12:55:00Z"},{"value":"0.07916","scoring_system":"epss","scoring_elements":"0.92043","published_at":"2026-04-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2012-4387"},{"reference_url":"http://secunia.com/advisories/50420","reference_id":"","reference_type":"","scores":[],"url":"http://secunia.com/advisories/50420"},{"reference_url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/78183","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/78183"},{"reference_url":"https://github.com/apache/struts","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts"},{"reference_url":"https://github.com/apache/struts/commit/80e03182d66d9e6ab18f9a9a9b3c42725a1c89e9","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/80e03182d66d9e6ab18f9a9a9b3c42725a1c89e9"},{"reference_url":"https://github.com/apache/struts/commit/87935af56a27235e9399308ee1fcfb74f8edcefa","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/87935af56a27235e9399308ee1fcfb74f8edcefa"},{"reference_url":"https://issues.apache.org/jira/browse/WW-3860","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://issues.apache.org/jira/browse/WW-3860"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4387","reference_id":"","reference_type":"","scores":[{"value":"5.0","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:L/Au:N/C:N/I:N/A:P"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4387"},{"reference_url":"http://struts.apache.org/2.x/docs/s2-011.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://struts.apache.org/2.x/docs/s2-011.html"},{"reference_url":"http://struts.apache.org/docs/s2-011.html","reference_id":"","reference_type":"","scores":[],"url":"http://struts.apache.org/docs/s2-011.html"},{"reference_url":"http://www.openwall.com/lists/oss-security/2012/09/01/4","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2012/09/01/4"},{"reference_url":"http://www.openwall.com/lists/oss-security/2012/09/01/5","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2012/09/01/5"},{"reference_url":"http://www.securityfocus.com/bid/55346","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/55346"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*"},{"reference_url":"https://github.com/advisories/GHSA-hrgc-54mv-58gv","reference_id":"GHSA-hrgc-54mv-58gv","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hrgc-54mv-58gv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20101?format=json","purl":"pkg:maven/org.apache.struts/struts2-core@2.3.4.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2chz-36wn-9fcv"},{"vulnerability":"VCID-2rjv-1thm-dugt"},{"vulnerability":"VCID-2v7h-fght-cugn"},{"vulnerability":"VCID-3yq7-n972-j7dh"},{"vulnerability":"VCID-4agy-6nsx-7ufh"},{"vulnerability":"VCID-579w-2k2v-efa2"},{"vulnerability":"VCID-6241-shkt-s7ew"},{"vulnerability":"VCID-6hrc-fm64-ckhf"},{"vulnerability":"VCID-6t1x-s2k2-b7bq"},{"vulnerability":"VCID-74ab-1p1c-4qbd"},{"vulnerability":"VCID-759g-hsfg-97f8"},{"vulnerability":"VCID-79j9-v8gz-rfax"},{"vulnerability":"VCID-7c97-nj5a-hqb8"},{"vulnerability":"VCID-87fh-rvvb-6ubq"},{"vulnerability":"VCID-8bsh-bshc-vkgq"},{"vulnerability":"VCID-8mws-fbmg-cqa9"},{"vulnerability":"VCID-95ts-vpk6-uubg"},{"vulnerability":"VCID-at5c-f8p8-67fh"},{"vulnerability":"VCID-b59n-uxft-4qgz"},{"vulnerability":"VCID-b7zy-qhz9-tuar"},{"vulnerability":"VCID-bgbt-j1n9-6yg5"},{"vulnerability":"VCID-cm62-bsdz-yye2"},{"vulnerability":"VCID-dk2f-14xj-9bf8"},{"vulnerability":"VCID-gfxq-vtry-bqgg"},{"vulnerability":"VCID-h4yg-zrv6-aqa1"},{"vulnerability":"VCID-hgj2-vqzn-gyeb"},{"vulnerability":"VCID-hkjh-35ye-1ugj"},{"vulnerability":"VCID-j5su-cnqd-6yad"},{"vulnerability":"VCID-kdsa-599r-eud7"},{"vulnerability":"VCID-me84-wy85-hkf5"},{"vulnerability":"VCID-n2dn-bnjc-13gp"},{"vulnerability":"VCID-n4fb-crnk-eugz"},{"vulnerability":"VCID-qqm4-frqy-bua5"},{"vulnerability":"VCID-tcaj-6bcg-k7g2"},{"vulnerability":"VCID-tgd1-s1yg-9fdt"},{"vulnerability":"VCID-vgp6-jxqt-pbf4"},{"vulnerability":"VCID-vkb9-11h4-dugp"},{"vulnerability":"VCID-vnkw-9fa2-zqcm"},{"vulnerability":"VCID-xz41-1z86-37ew"},{"vulnerability":"VCID-y5uq-a6dx-3yd4"},{"vulnerability":"VCID-ygbu-vb2t-jqhx"},{"vulnerability":"VCID-zb3c-gnyc-yug8"},{"vulnerability":"VCID-zxww-8kb3-tufv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.4.1"}],"aliases":["CVE-2012-4387","GHSA-hrgc-54mv-58gv"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-q96z-v3bs-k3dg"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/4652?format=json","vulnerability_id":"VCID-vkb9-11h4-dugp","summary":"Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-1966.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-1966.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2013-1966","reference_id":"","reference_type":"","scores":[{"value":"0.91096","scoring_system":"epss","scoring_elements":"0.99655","published_at":"2026-05-14T12:55:00Z"},{"value":"0.91096","scoring_system":"epss","scoring_elements":"0.99647","published_at":"2026-04-21T12:55:00Z"},{"value":"0.91096","scoring_system":"epss","scoring_elements":"0.99648","published_at":"2026-04-24T12:55:00Z"},{"value":"0.91096","scoring_system":"epss","scoring_elements":"0.99649","published_at":"2026-04-26T12:55:00Z"},{"value":"0.91096","scoring_system":"epss","scoring_elements":"0.9965","published_at":"2026-04-29T12:55:00Z"},{"value":"0.91096","scoring_system":"epss","scoring_elements":"0.99651","published_at":"2026-05-05T12:55:00Z"},{"value":"0.91096","scoring_system":"epss","scoring_elements":"0.99652","published_at":"2026-05-09T12:55:00Z"},{"value":"0.91096","scoring_system":"epss","scoring_elements":"0.99653","published_at":"2026-05-11T12:55:00Z"},{"value":"0.91096","scoring_system":"epss","scoring_elements":"0.99654","published_at":"2026-05-12T12:55:00Z"},{"value":"0.91096","scoring_system":"epss","scoring_elements":"0.99641","published_at":"2026-04-04T12:55:00Z"},{"value":"0.91096","scoring_system":"epss","scoring_elements":"0.9964","published_at":"2026-04-02T12:55:00Z"},{"value":"0.91096","scoring_system":"epss","scoring_elements":"0.99642","published_at":"2026-04-07T12:55:00Z"},{"value":"0.91096","scoring_system":"epss","scoring_elements":"0.99643","published_at":"2026-04-12T12:55:00Z"},{"value":"0.91096","scoring_system":"epss","scoring_elements":"0.99644","published_at":"2026-04-16T12:55:00Z"},{"value":"0.91096","scoring_system":"epss","scoring_elements":"0.99646","published_at":"2026-04-18T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2013-1966"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=967656","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=967656"},{"reference_url":"https://cwiki.apache.org/confluence/display/WW/S2-013","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://cwiki.apache.org/confluence/display/WW/S2-013"},{"reference_url":"https://github.com/apache/struts","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts"},{"reference_url":"https://github.com/apache/struts/commit/7e6f641ebb142663cbd1653dc49bed725edf7f56","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/7e6f641ebb142663cbd1653dc49bed725edf7f56"},{"reference_url":"http://struts.apache.org/development/2.x/docs/s2-013.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://struts.apache.org/development/2.x/docs/s2-013.html"},{"reference_url":"http://struts.apache.org/docs/s2-013.html","reference_id":"","reference_type":"","scores":[],"url":"http://struts.apache.org/docs/s2-013.html"},{"reference_url":"http://struts.apache.org/docs/s2-014.html","reference_id":"","reference_type":"","scores":[],"url":"http://struts.apache.org/docs/s2-014.html"},{"reference_url":"http://www.securityfocus.com/bid/60166","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/60166"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1966","reference_id":"CVE-2013-1966","reference_type":"","scores":[{"value":"9.3","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:C/I:C/A:C"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1966"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/25980.rb","reference_id":"CVE-2013-2115;OSVDB-93645;CVE-2013-1966","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/25980.rb"},{"reference_url":"https://github.com/advisories/GHSA-737w-mh58-cxjp","reference_id":"GHSA-737w-mh58-cxjp","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-737w-mh58-cxjp"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20314?format=json","purl":"pkg:maven/org.apache.struts/struts2-core@2.3.14.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2chz-36wn-9fcv"},{"vulnerability":"VCID-2rjv-1thm-dugt"},{"vulnerability":"VCID-2v7h-fght-cugn"},{"vulnerability":"VCID-3yq7-n972-j7dh"},{"vulnerability":"VCID-4agy-6nsx-7ufh"},{"vulnerability":"VCID-579w-2k2v-efa2"},{"vulnerability":"VCID-6241-shkt-s7ew"},{"vulnerability":"VCID-6hrc-fm64-ckhf"},{"vulnerability":"VCID-6t1x-s2k2-b7bq"},{"vulnerability":"VCID-74ab-1p1c-4qbd"},{"vulnerability":"VCID-759g-hsfg-97f8"},{"vulnerability":"VCID-79j9-v8gz-rfax"},{"vulnerability":"VCID-7c97-nj5a-hqb8"},{"vulnerability":"VCID-87fh-rvvb-6ubq"},{"vulnerability":"VCID-8bsh-bshc-vkgq"},{"vulnerability":"VCID-8mws-fbmg-cqa9"},{"vulnerability":"VCID-95ts-vpk6-uubg"},{"vulnerability":"VCID-at5c-f8p8-67fh"},{"vulnerability":"VCID-b59n-uxft-4qgz"},{"vulnerability":"VCID-b7zy-qhz9-tuar"},{"vulnerability":"VCID-bgbt-j1n9-6yg5"},{"vulnerability":"VCID-cm62-bsdz-yye2"},{"vulnerability":"VCID-dk2f-14xj-9bf8"},{"vulnerability":"VCID-gfxq-vtry-bqgg"},{"vulnerability":"VCID-h4yg-zrv6-aqa1"},{"vulnerability":"VCID-hgj2-vqzn-gyeb"},{"vulnerability":"VCID-j5su-cnqd-6yad"},{"vulnerability":"VCID-kdsa-599r-eud7"},{"vulnerability":"VCID-mdde-pa5h-w7g4"},{"vulnerability":"VCID-me84-wy85-hkf5"},{"vulnerability":"VCID-n2dn-bnjc-13gp"},{"vulnerability":"VCID-n4fb-crnk-eugz"},{"vulnerability":"VCID-qqm4-frqy-bua5"},{"vulnerability":"VCID-tcaj-6bcg-k7g2"},{"vulnerability":"VCID-tgd1-s1yg-9fdt"},{"vulnerability":"VCID-vgp6-jxqt-pbf4"},{"vulnerability":"VCID-vnkw-9fa2-zqcm"},{"vulnerability":"VCID-xz41-1z86-37ew"},{"vulnerability":"VCID-y4qu-21c9-6fav"},{"vulnerability":"VCID-y5uq-a6dx-3yd4"},{"vulnerability":"VCID-ygbu-vb2t-jqhx"},{"vulnerability":"VCID-zb3c-gnyc-yug8"},{"vulnerability":"VCID-zxww-8kb3-tufv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.14.2"}],"aliases":["CVE-2013-1966","GHSA-737w-mh58-cxjp"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"8.4","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vkb9-11h4-dugp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/4544?format=json","vulnerability_id":"VCID-vnkw-9fa2-zqcm","summary":"Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both \"${}\" and \"%{}\" sequences, which causes the OGNL code to be evaluated twice.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2135","reference_id":"","reference_type":"","scores":[{"value":"0.83013","scoring_system":"epss","scoring_elements":"0.99271","published_at":"2026-05-14T12:55:00Z"},{"value":"0.83013","scoring_system":"epss","scoring_elements":"0.99245","published_at":"2026-04-01T12:55:00Z"},{"value":"0.83013","scoring_system":"epss","scoring_elements":"0.99247","published_at":"2026-04-02T12:55:00Z"},{"value":"0.83013","scoring_system":"epss","scoring_elements":"0.9925","published_at":"2026-04-04T12:55:00Z"},{"value":"0.83013","scoring_system":"epss","scoring_elements":"0.99253","published_at":"2026-04-07T12:55:00Z"},{"value":"0.83013","scoring_system":"epss","scoring_elements":"0.99254","published_at":"2026-04-08T12:55:00Z"},{"value":"0.83013","scoring_system":"epss","scoring_elements":"0.99255","published_at":"2026-04-13T12:55:00Z"},{"value":"0.83013","scoring_system":"epss","scoring_elements":"0.99256","published_at":"2026-04-12T12:55:00Z"},{"value":"0.83013","scoring_system":"epss","scoring_elements":"0.99257","published_at":"2026-04-18T12:55:00Z"},{"value":"0.83013","scoring_system":"epss","scoring_elements":"0.99258","published_at":"2026-04-21T12:55:00Z"},{"value":"0.83013","scoring_system":"epss","scoring_elements":"0.99261","published_at":"2026-04-26T12:55:00Z"},{"value":"0.83013","scoring_system":"epss","scoring_elements":"0.99262","published_at":"2026-04-29T12:55:00Z"},{"value":"0.83013","scoring_system":"epss","scoring_elements":"0.99266","published_at":"2026-05-05T12:55:00Z"},{"value":"0.83013","scoring_system":"epss","scoring_elements":"0.99267","published_at":"2026-05-11T12:55:00Z"},{"value":"0.83013","scoring_system":"epss","scoring_elements":"0.99268","published_at":"2026-05-09T12:55:00Z"},{"value":"0.83013","scoring_system":"epss","scoring_elements":"0.99269","published_at":"2026-05-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2135"},{"reference_url":"https://cwiki.apache.org/confluence/display/WW/S2-015","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://cwiki.apache.org/confluence/display/WW/S2-015"},{"reference_url":"https://github.com/apache/struts","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts"},{"reference_url":"https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e"},{"reference_url":"https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e0","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/01e6b251b4db78bfb7971033652e81d1af4cb3e0"},{"reference_url":"https://github.com/apache/struts/commit/041206d2a693d02c0cb2e72765275e55ba14049f","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/041206d2a693d02c0cb2e72765275e55ba14049f"},{"reference_url":"https://github.com/apache/struts/commit/113c47082c09818bcef65acc436a2d0c7c47aa6c","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/113c47082c09818bcef65acc436a2d0c7c47aa6c"},{"reference_url":"https://github.com/apache/struts/commit/54e5c912ebd9a1599bfcf7a719da17c28127bbe","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/struts/commit/54e5c912ebd9a1599bfcf7a719da17c28127bbe"},{"reference_url":"https://github.com/apache/struts/commit/54e5c912ebd9a1599bfcf7a719da17c28127bbe3","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/54e5c912ebd9a1599bfcf7a719da17c28127bbe3"},{"reference_url":"https://github.com/apache/struts/commit/711cf0201cdd319a38cf29238913312355db29ba","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/711cf0201cdd319a38cf29238913312355db29ba"},{"reference_url":"https://github.com/apache/struts/commit/8b4fc81daeea3834bcbf73de5f48d0021917aa3","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/struts/commit/8b4fc81daeea3834bcbf73de5f48d0021917aa3"},{"reference_url":"https://github.com/apache/struts/commit/8b4fc81daeea3834bcbf73de5f48d0021917aa37","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/8b4fc81daeea3834bcbf73de5f48d0021917aa37"},{"reference_url":"https://github.com/apache/struts/commit/cfb6e9afbae320a4dd5bdd655154ab9fe5a92c1","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/struts/commit/cfb6e9afbae320a4dd5bdd655154ab9fe5a92c1"},{"reference_url":"https://github.com/apache/struts/commit/cfb6e9afbae320a4dd5bdd655154ab9fe5a92c16","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/cfb6e9afbae320a4dd5bdd655154ab9fe5a92c16"},{"reference_url":"https://issues.apache.org/jira/browse/WW-4090","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://issues.apache.org/jira/browse/WW-4090"},{"reference_url":"https://issues.apache.org/jira/browse/WW-4094","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://issues.apache.org/jira/browse/WW-4094"},{"reference_url":"https://issues.apache.org/jira/browse/WW-4095","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://issues.apache.org/jira/browse/WW-4095"},{"reference_url":"http://struts.apache.org/development/2.x/docs/s2-015.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://struts.apache.org/development/2.x/docs/s2-015.html"},{"reference_url":"http://struts.apache.org/docs/s2-015.html","reference_id":"","reference_type":"","scores":[],"url":"http://struts.apache.org/docs/s2-015.html"},{"reference_url":"https://web.archive.org/web/20140410223942/http://www.securityfocus.com/bid/64758","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20140410223942/http://www.securityfocus.com/bid/64758"},{"reference_url":"http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"},{"reference_url":"http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html"},{"reference_url":"http://www.securityfocus.com/bid/64758","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/64758"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2135","reference_id":"CVE-2013-2135","reference_type":"","scores":[{"value":"9.3","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:C/I:C/A:C"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2135"},{"reference_url":"https://github.com/advisories/GHSA-pw8r-x2qm-3h5m","reference_id":"GHSA-pw8r-x2qm-3h5m","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-pw8r-x2qm-3h5m"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20324?format=json","purl":"pkg:maven/org.apache.struts/struts2-core@2.3.14.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2chz-36wn-9fcv"},{"vulnerability":"VCID-2rjv-1thm-dugt"},{"vulnerability":"VCID-2v7h-fght-cugn"},{"vulnerability":"VCID-3yq7-n972-j7dh"},{"vulnerability":"VCID-4agy-6nsx-7ufh"},{"vulnerability":"VCID-579w-2k2v-efa2"},{"vulnerability":"VCID-6hrc-fm64-ckhf"},{"vulnerability":"VCID-6t1x-s2k2-b7bq"},{"vulnerability":"VCID-74ab-1p1c-4qbd"},{"vulnerability":"VCID-759g-hsfg-97f8"},{"vulnerability":"VCID-79j9-v8gz-rfax"},{"vulnerability":"VCID-7c97-nj5a-hqb8"},{"vulnerability":"VCID-87fh-rvvb-6ubq"},{"vulnerability":"VCID-8bsh-bshc-vkgq"},{"vulnerability":"VCID-8mws-fbmg-cqa9"},{"vulnerability":"VCID-95ts-vpk6-uubg"},{"vulnerability":"VCID-at5c-f8p8-67fh"},{"vulnerability":"VCID-b59n-uxft-4qgz"},{"vulnerability":"VCID-b7zy-qhz9-tuar"},{"vulnerability":"VCID-bgbt-j1n9-6yg5"},{"vulnerability":"VCID-cm62-bsdz-yye2"},{"vulnerability":"VCID-dk2f-14xj-9bf8"},{"vulnerability":"VCID-gfxq-vtry-bqgg"},{"vulnerability":"VCID-h4yg-zrv6-aqa1"},{"vulnerability":"VCID-hgj2-vqzn-gyeb"},{"vulnerability":"VCID-j5su-cnqd-6yad"},{"vulnerability":"VCID-kdsa-599r-eud7"},{"vulnerability":"VCID-mdde-pa5h-w7g4"},{"vulnerability":"VCID-me84-wy85-hkf5"},{"vulnerability":"VCID-n2dn-bnjc-13gp"},{"vulnerability":"VCID-qqm4-frqy-bua5"},{"vulnerability":"VCID-tcaj-6bcg-k7g2"},{"vulnerability":"VCID-tgd1-s1yg-9fdt"},{"vulnerability":"VCID-vgp6-jxqt-pbf4"},{"vulnerability":"VCID-xz41-1z86-37ew"},{"vulnerability":"VCID-y4qu-21c9-6fav"},{"vulnerability":"VCID-y5uq-a6dx-3yd4"},{"vulnerability":"VCID-ygbu-vb2t-jqhx"},{"vulnerability":"VCID-zb3c-gnyc-yug8"},{"vulnerability":"VCID-zxww-8kb3-tufv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.3.14.3"}],"aliases":["CVE-2013-2135","GHSA-pw8r-x2qm-3h5m"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"8.4","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vnkw-9fa2-zqcm"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6699?format=json","vulnerability_id":"VCID-x65e-31g3-77bp","summary":"Multiple XSS flaws in XWork\nMultiple cross-site scripting (XSS) vulnerabilities in XWork allow remote attackers to inject arbitrary web script or HTML via vectors involving an action name, the action attribute of an s:submit element, or the method attribute of an `s:submit` element.","references":[{"reference_url":"http://jvndb.jvn.jp/jvndb/JVNDB-2011-000106","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2011-000106"},{"reference_url":"http://jvn.jp/en/jp/JVN25435092/index.html","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://jvn.jp/en/jp/JVN25435092/index.html"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-1772.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-1772.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2011-1772","reference_id":"","reference_type":"","scores":[{"value":"0.59227","scoring_system":"epss","scoring_elements":"0.98252","published_at":"2026-05-11T12:55:00Z"},{"value":"0.59227","scoring_system":"epss","scoring_elements":"0.98237","published_at":"2026-04-13T12:55:00Z"},{"value":"0.59227","scoring_system":"epss","scoring_elements":"0.98256","published_at":"2026-05-14T12:55:00Z"},{"value":"0.59227","scoring_system":"epss","scoring_elements":"0.98242","published_at":"2026-04-21T12:55:00Z"},{"value":"0.59227","scoring_system":"epss","scoring_elements":"0.98255","published_at":"2026-05-12T12:55:00Z"},{"value":"0.59227","scoring_system":"epss","scoring_elements":"0.98251","published_at":"2026-05-07T12:55:00Z"},{"value":"0.59227","scoring_system":"epss","scoring_elements":"0.98223","published_at":"2026-04-01T12:55:00Z"},{"value":"0.59227","scoring_system":"epss","scoring_elements":"0.98246","published_at":"2026-04-29T12:55:00Z"},{"value":"0.59227","scoring_system":"epss","scoring_elements":"0.98225","published_at":"2026-04-02T12:55:00Z"},{"value":"0.59227","scoring_system":"epss","scoring_elements":"0.98244","published_at":"2026-04-24T12:55:00Z"},{"value":"0.59227","scoring_system":"epss","scoring_elements":"0.98228","published_at":"2026-04-04T12:55:00Z"},{"value":"0.59227","scoring_system":"epss","scoring_elements":"0.98229","published_at":"2026-04-07T12:55:00Z"},{"value":"0.59227","scoring_system":"epss","scoring_elements":"0.98234","published_at":"2026-04-09T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2011-1772"},{"reference_url":"http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.html"},{"reference_url":"http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html","reference_id":"","reference_type":"","scores":[],"url":"http://secureappdev.blogspot.com/2011/05/Struts_2_XWork_WebWork_XSS_in_error_pages.html"},{"reference_url":"https://github.com/apache/struts","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts"},{"reference_url":"https://issues.apache.org/jira/browse/WW-3579","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://issues.apache.org/jira/browse/WW-3579"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2011-1772","reference_id":"","reference_type":"","scores":[{"value":"2.6","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:H/Au:N/C:N/I:P/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-1772"},{"reference_url":"http://struts.apache.org/2.2.3/docs/version-notes-223.html","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://struts.apache.org/2.2.3/docs/version-notes-223.html"},{"reference_url":"http://struts.apache.org/2.x/docs/s2-006.html","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://struts.apache.org/2.x/docs/s2-006.html"},{"reference_url":"http://struts.apache.org/docs/s2-006.html","reference_id":"","reference_type":"","scores":[],"url":"http://struts.apache.org/docs/s2-006.html"},{"reference_url":"http://www.securityfocus.com/bid/47784","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/47784"},{"reference_url":"http://www.ventuneac.net/security-advisories/MVSA-11-006","reference_id":"","reference_type":"","scores":[],"url":"http://www.ventuneac.net/security-advisories/MVSA-11-006"},{"reference_url":"http://www.vupen.com/english/advisories/2011/1198","reference_id":"","reference_type":"","scores":[],"url":"http://www.vupen.com/english/advisories/2011/1198"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=723827","reference_id":"723827","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=723827"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:opensymphony:webwork:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:opensymphony:webwork:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:opensymphony:webwork:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:opensymphony:xwork:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:opensymphony:xwork:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:opensymphony:xwork:*:*:*:*:*:*:*:*"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/35735.txt","reference_id":"CVE-2011-1772;OSVDB-72238","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/35735.txt"},{"reference_url":"https://www.securityfocus.com/bid/47784/info","reference_id":"CVE-2011-1772;OSVDB-72238","reference_type":"exploit","scores":[],"url":"https://www.securityfocus.com/bid/47784/info"},{"reference_url":"https://github.com/advisories/GHSA-56f8-g68r-j699","reference_id":"GHSA-56f8-g68r-j699","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-56f8-g68r-j699"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20006?format=json","purl":"pkg:maven/org.apache.struts/struts2-core@2.2.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2chz-36wn-9fcv"},{"vulnerability":"VCID-2rjv-1thm-dugt"},{"vulnerability":"VCID-2v7h-fght-cugn"},{"vulnerability":"VCID-3yq7-n972-j7dh"},{"vulnerability":"VCID-4agy-6nsx-7ufh"},{"vulnerability":"VCID-579w-2k2v-efa2"},{"vulnerability":"VCID-6241-shkt-s7ew"},{"vulnerability":"VCID-6hrc-fm64-ckhf"},{"vulnerability":"VCID-6t1x-s2k2-b7bq"},{"vulnerability":"VCID-759g-hsfg-97f8"},{"vulnerability":"VCID-79j9-v8gz-rfax"},{"vulnerability":"VCID-87fh-rvvb-6ubq"},{"vulnerability":"VCID-8bsh-bshc-vkgq"},{"vulnerability":"VCID-8mws-fbmg-cqa9"},{"vulnerability":"VCID-95ts-vpk6-uubg"},{"vulnerability":"VCID-at5c-f8p8-67fh"},{"vulnerability":"VCID-b59n-uxft-4qgz"},{"vulnerability":"VCID-b7zy-qhz9-tuar"},{"vulnerability":"VCID-bgbt-j1n9-6yg5"},{"vulnerability":"VCID-cm62-bsdz-yye2"},{"vulnerability":"VCID-dk2f-14xj-9bf8"},{"vulnerability":"VCID-fv6w-cdtc-kkhx"},{"vulnerability":"VCID-gfxq-vtry-bqgg"},{"vulnerability":"VCID-gv5f-auvz-5fda"},{"vulnerability":"VCID-h4yg-zrv6-aqa1"},{"vulnerability":"VCID-hgj2-vqzn-gyeb"},{"vulnerability":"VCID-hkjh-35ye-1ugj"},{"vulnerability":"VCID-j5su-cnqd-6yad"},{"vulnerability":"VCID-k6mz-k1yb-4uej"},{"vulnerability":"VCID-kdsa-599r-eud7"},{"vulnerability":"VCID-me84-wy85-hkf5"},{"vulnerability":"VCID-n2dn-bnjc-13gp"},{"vulnerability":"VCID-n4fb-crnk-eugz"},{"vulnerability":"VCID-nmgp-r7hb-5ke1"},{"vulnerability":"VCID-q96z-v3bs-k3dg"},{"vulnerability":"VCID-qqm4-frqy-bua5"},{"vulnerability":"VCID-r28t-sdc5-kbga"},{"vulnerability":"VCID-tcaj-6bcg-k7g2"},{"vulnerability":"VCID-tgd1-s1yg-9fdt"},{"vulnerability":"VCID-vgp6-jxqt-pbf4"},{"vulnerability":"VCID-vkb9-11h4-dugp"},{"vulnerability":"VCID-vnkw-9fa2-zqcm"},{"vulnerability":"VCID-xz41-1z86-37ew"},{"vulnerability":"VCID-y5uq-a6dx-3yd4"},{"vulnerability":"VCID-ygbu-vb2t-jqhx"},{"vulnerability":"VCID-z1gf-169n-m3af"},{"vulnerability":"VCID-zb3c-gnyc-yug8"},{"vulnerability":"VCID-zxww-8kb3-tufv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.2.3"}],"aliases":["CVE-2011-1772","GHSA-56f8-g68r-j699"],"risk_score":5.4,"exploitability":"2.0","weighted_severity":"2.7","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-x65e-31g3-77bp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5020?format=json","vulnerability_id":"VCID-z1gf-169n-m3af","summary":"Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.","references":[{"reference_url":"http://jvndb.jvn.jp/jvndb/JVNDB-2012-000012","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2012-000012"},{"reference_url":"http://jvn.jp/en/jp/JVN79099262/index.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://jvn.jp/en/jp/JVN79099262/index.html"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-0838.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-0838.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2012-0838","reference_id":"","reference_type":"","scores":[{"value":"0.11109","scoring_system":"epss","scoring_elements":"0.93543","published_at":"2026-05-14T12:55:00Z"},{"value":"0.11109","scoring_system":"epss","scoring_elements":"0.9346","published_at":"2026-04-12T12:55:00Z"},{"value":"0.11109","scoring_system":"epss","scoring_elements":"0.93461","published_at":"2026-04-13T12:55:00Z"},{"value":"0.11109","scoring_system":"epss","scoring_elements":"0.93481","published_at":"2026-04-16T12:55:00Z"},{"value":"0.11109","scoring_system":"epss","scoring_elements":"0.93486","published_at":"2026-04-18T12:55:00Z"},{"value":"0.11109","scoring_system":"epss","scoring_elements":"0.93492","published_at":"2026-04-21T12:55:00Z"},{"value":"0.11109","scoring_system":"epss","scoring_elements":"0.93496","published_at":"2026-04-24T12:55:00Z"},{"value":"0.11109","scoring_system":"epss","scoring_elements":"0.93493","published_at":"2026-04-29T12:55:00Z"},{"value":"0.11109","scoring_system":"epss","scoring_elements":"0.935","published_at":"2026-05-05T12:55:00Z"},{"value":"0.11109","scoring_system":"epss","scoring_elements":"0.93514","published_at":"2026-05-07T12:55:00Z"},{"value":"0.11109","scoring_system":"epss","scoring_elements":"0.93525","published_at":"2026-05-11T12:55:00Z"},{"value":"0.11109","scoring_system":"epss","scoring_elements":"0.93531","published_at":"2026-05-12T12:55:00Z"},{"value":"0.11109","scoring_system":"epss","scoring_elements":"0.93443","published_at":"2026-04-07T12:55:00Z"},{"value":"0.11109","scoring_system":"epss","scoring_elements":"0.93451","published_at":"2026-04-08T12:55:00Z"},{"value":"0.11109","scoring_system":"epss","scoring_elements":"0.93455","published_at":"2026-04-09T12:55:00Z"},{"value":"0.13997","scoring_system":"epss","scoring_elements":"0.94295","published_at":"2026-04-01T12:55:00Z"},{"value":"0.13997","scoring_system":"epss","scoring_elements":"0.94315","published_at":"2026-04-04T12:55:00Z"},{"value":"0.13997","scoring_system":"epss","scoring_elements":"0.94304","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2012-0838"},{"reference_url":"https://github.com/apache/struts","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts"},{"reference_url":"https://github.com/apache/struts/commit/25e50069d60434a30395e3a98357ffba2bed427e","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/25e50069d60434a30395e3a98357ffba2bed427e"},{"reference_url":"https://github.com/apache/struts/commit/5f54b8d087f5125d96838aafa5f64c2190e6885b","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/5f54b8d087f5125d96838aafa5f64c2190e6885b"},{"reference_url":"https://github.com/apache/struts/commit/b4265d369dc29d57a9f2846a85b26598e83f3892","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/struts/commit/b4265d369dc29d57a9f2846a85b26598e83f3892"},{"reference_url":"https://issues.apache.org/jira/browse/WW-3668","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://issues.apache.org/jira/browse/WW-3668"},{"reference_url":"http://struts.apache.org/2.3.1.2/docs/s2-007.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://struts.apache.org/2.3.1.2/docs/s2-007.html"},{"reference_url":"http://struts.apache.org/docs/s2-007.html","reference_id":"","reference_type":"","scores":[],"url":"http://struts.apache.org/docs/s2-007.html"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=799980","reference_id":"799980","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=799980"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0838","reference_id":"CVE-2012-0838","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0838"},{"reference_url":"https://github.com/advisories/GHSA-mwrx-hx6x-3hhv","reference_id":"GHSA-mwrx-hx6x-3hhv","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mwrx-hx6x-3hhv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/20038?format=json","purl":"pkg:maven/org.apache.struts/struts2-core@2.2.3.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2chz-36wn-9fcv"},{"vulnerability":"VCID-2rjv-1thm-dugt"},{"vulnerability":"VCID-2v7h-fght-cugn"},{"vulnerability":"VCID-3yq7-n972-j7dh"},{"vulnerability":"VCID-4agy-6nsx-7ufh"},{"vulnerability":"VCID-579w-2k2v-efa2"},{"vulnerability":"VCID-6241-shkt-s7ew"},{"vulnerability":"VCID-6hrc-fm64-ckhf"},{"vulnerability":"VCID-6t1x-s2k2-b7bq"},{"vulnerability":"VCID-759g-hsfg-97f8"},{"vulnerability":"VCID-79j9-v8gz-rfax"},{"vulnerability":"VCID-87fh-rvvb-6ubq"},{"vulnerability":"VCID-8bsh-bshc-vkgq"},{"vulnerability":"VCID-8mws-fbmg-cqa9"},{"vulnerability":"VCID-95ts-vpk6-uubg"},{"vulnerability":"VCID-at5c-f8p8-67fh"},{"vulnerability":"VCID-b59n-uxft-4qgz"},{"vulnerability":"VCID-b7zy-qhz9-tuar"},{"vulnerability":"VCID-bgbt-j1n9-6yg5"},{"vulnerability":"VCID-cm62-bsdz-yye2"},{"vulnerability":"VCID-dk2f-14xj-9bf8"},{"vulnerability":"VCID-fv6w-cdtc-kkhx"},{"vulnerability":"VCID-gfxq-vtry-bqgg"},{"vulnerability":"VCID-h4yg-zrv6-aqa1"},{"vulnerability":"VCID-hgj2-vqzn-gyeb"},{"vulnerability":"VCID-hkjh-35ye-1ugj"},{"vulnerability":"VCID-j5su-cnqd-6yad"},{"vulnerability":"VCID-k6mz-k1yb-4uej"},{"vulnerability":"VCID-kdsa-599r-eud7"},{"vulnerability":"VCID-me84-wy85-hkf5"},{"vulnerability":"VCID-n2dn-bnjc-13gp"},{"vulnerability":"VCID-n4fb-crnk-eugz"},{"vulnerability":"VCID-q96z-v3bs-k3dg"},{"vulnerability":"VCID-qqm4-frqy-bua5"},{"vulnerability":"VCID-tcaj-6bcg-k7g2"},{"vulnerability":"VCID-tgd1-s1yg-9fdt"},{"vulnerability":"VCID-vgp6-jxqt-pbf4"},{"vulnerability":"VCID-vkb9-11h4-dugp"},{"vulnerability":"VCID-vnkw-9fa2-zqcm"},{"vulnerability":"VCID-xz41-1z86-37ew"},{"vulnerability":"VCID-y5uq-a6dx-3yd4"},{"vulnerability":"VCID-ygbu-vb2t-jqhx"},{"vulnerability":"VCID-zb3c-gnyc-yug8"},{"vulnerability":"VCID-zxww-8kb3-tufv"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2.2.3.1"}],"aliases":["CVE-2012-0838","GHSA-mwrx-hx6x-3hhv"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-z1gf-169n-m3af"}],"fixing_vulnerabilities":[],"risk_score":"10.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.struts/struts2-core@2-alpha0"}