org.apache.struts.xwork:xwork-core (Maven)
Advisories
17
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.3.29 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.apache.struts.xwork</groupId><artifactId>xwork-core</artifactId><version>2.3.29</version></dependency>gradle
implementation("org.apache.struts.xwork:xwork-core:2.3.29")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-qcfc-hmrc-59x7 Apache Struts 2 is Missing XML Validation |
High EPSS 50.42% |
>= 2.2.1 | No fix yet |
| GHSA-wm8w-qp2f-728q Apache Struts Open Redirect |
High EPSS 9.75% |
>= 2.3.20, < 2.3.29 | 2.3.29 |
| GHSA-hrgc-54mv-58gv Denial of service in Apache Struts |
Medium EPSS 8.14% |
>= 2.0.0, < 2.3.4.1 | 2.3.4.1 |
| GHSA-q2cg-xf9p-h457 Incomplete exclude pattern in Apache Struts |
High EPSS 6.32% |
>= 2.0.0, < 2.3.20.1 | 2.3.20.1 |
| GHSA-38qw-j787-v8c2 Apache Struts CSRF Vulnerability |
High EPSS 3.70% |
>= 2.3.20, < 2.3.29 | 2.3.29 |
| GHSA-9ccm-g362-2r35 XWork in Apache Struts Reveals Sensitive Information |
Medium EPSS 6.14% |
< 2.2.2 | 2.2.2 |
| GHSA-gqqm-564f-vvxq Arbitrary code execution in Apache Struts 2 |
High EPSS 70.21% |
>= 2.0.0, < 2.3.14.3 | 2.3.14.3 |
| GHSA-pw8r-x2qm-3h5m Arbitrary code execution in Apache Struts 2 |
High EPSS 13.83% |
>= 2.0.0, < 2.3.14.3 | 2.3.14.3 |
| GHSA-mwrx-hx6x-3hhv Apache Struts Code injection due to conversion error |
High EPSS 13.69% |
< 2.2.3.1 | 2.2.3.1 |
| GHSA-vrwc-qjmw-5rjm ClassLoader manipulation in Apache Struts |
Medium EPSS 99.39% |
>= 2.0.0, < 2.3.16.2 | 2.3.16.2 |
| GHSA-737w-mh58-cxjp Arbitrary code execution in Apache Struts |
High EPSS 73.70% |
>= 2.0.0, < 2.3.14.2 | 2.3.14.2 |
| GHSA-7ghm-rpc7-p7g5 Code injection in Apache Struts |
High EPSS 74.64% |
>= 2.0.0, < 2.3.14.2 | 2.3.14.2 |
| GHSA-2ppp-xj34-vvf7 Apache Struts's CookieInterceptor component does not use the parameter-name whitelist |
Medium EPSS 97.53% |
< 2.2.3.1 | 2.2.3.1 |
| GHSA-4wrr-9h5r-m92w Apache Struts Remote Java Code Execution Known exploited |
Critical EPSS 75.60% |
< 2.2.3.1 | 2.2.3.1 |
| GHSA-4wrr-9h5r-m92w Apache Struts Remote Java Code Execution Known exploited |
Critical EPSS 75.60% |
< 2.2.3.1 | 2.2.3.1 |
| GHSA-hxqq-w4mr-mc62 Apache Struts's ParameterInterceptor component does not prevent access to public constructors |
Medium EPSS 36.32% |
< 2.2.3.1 | 2.2.3.1 |
| GHSA-hmvj-gc9q-mg9p Apache Struts's DebuggingInterceptor component allows remote code execution in developer mode |
Medium EPSS 72.90% |
< 2.3.18 | 2.3.18 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor