org.apache.struts:struts2-core (Maven)
Advisories
94
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 7.1.1 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.apache.struts</groupId><artifactId>struts2-core</artifactId><version>7.1.1</version></dependency>gradle
implementation("org.apache.struts:struts2-core:7.1.1")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-qcfc-hmrc-59x7 Apache Struts 2 is Missing XML Validation |
High EPSS 50.42% |
>= 6.0.0, < 6.1.1 | 6.1.1 |
| GHSA-qcfc-hmrc-59x7 Apache Struts 2 is Missing XML Validation |
High EPSS 50.42% |
>= 2.0.0, <= 2.3.37 | No fix yet |
| GHSA-qcfc-hmrc-59x7 Apache Struts 2 is Missing XML Validation |
High EPSS 50.42% |
>= 2.5.0, <= 2.5.33 | No fix yet |
| GHSA-rg58-xhh7-mqjw Apache Struts has a Denial of Service vulnerability |
High EPSS 0.59% |
>= 7.0.0, < 7.1.1 | 7.1.1 |
| GHSA-rg58-xhh7-mqjw Apache Struts has a Denial of Service vulnerability |
High EPSS 0.59% |
>= 2.0.0, < 6.8.0 | 6.8.0 |
| GHSA-xx7v-hqxh-cjr9 Apache Struts is Vulnerable to DoS via File Leak |
High EPSS 1.52% |
>= 2.5.0, <= 2.5.33 | No fix yet |
| GHSA-xx7v-hqxh-cjr9 Apache Struts is Vulnerable to DoS via File Leak |
High EPSS 1.52% |
>= 6.0.0, < 6.8.0 | 6.8.0 |
| GHSA-xx7v-hqxh-cjr9 Apache Struts is Vulnerable to DoS via File Leak |
High EPSS 1.52% |
>= 7.0.0, < 7.1.1 | 7.1.1 |
| GHSA-xx7v-hqxh-cjr9 Apache Struts is Vulnerable to DoS via File Leak |
High EPSS 1.52% |
>= 2.0.0, <= 2.3.37 | No fix yet |
| GHSA-43mq-6xmg-29vm Apache Struts file upload logic is flawed |
Critical EPSS 72.37% |
< 6.4.0 | 6.4.0 |
| GHSA-2j39-qcjm-428w Apache Struts vulnerable to path traversal |
Critical EPSS 80.82% |
>= 2.0.0, < 2.5.33 | 2.5.33 |
| GHSA-2j39-qcjm-428w Apache Struts vulnerable to path traversal |
Critical EPSS 80.82% |
>= 6.0.0, < 6.3.0.2 | 6.3.0.2 |
| GHSA-729q-fcgp-r5xh Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability |
High EPSS 7.30% |
>= 6.2.0, < 6.3.0.1 | 6.3.0.1 |
| GHSA-729q-fcgp-r5xh Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability |
High EPSS 7.30% |
>= 6.0.0, < 6.1.2.2 | 6.1.2.2 |
| GHSA-729q-fcgp-r5xh Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability |
High EPSS 7.30% |
< 2.5.32 | 2.5.32 |
| GHSA-4g42-gqrg-4633 Apache Struts vulnerable to memory exhaustion |
High EPSS 5.51% |
< 2.5.31 | 2.5.31 |
| GHSA-4g42-gqrg-4633 Apache Struts vulnerable to memory exhaustion |
High EPSS 5.51% |
>= 6.0.0, < 6.1.2.1 | 6.1.2.1 |
| GHSA-8f6x-v685-g2xc Apache Struts vulnerable to memory exhaustion |
Medium EPSS 5.45% |
< 2.5.31 | 2.5.31 |
| GHSA-8f6x-v685-g2xc Apache Struts vulnerable to memory exhaustion |
Medium EPSS 5.45% |
>= 6.0.0, < 6.1.2.1 | 6.1.2.1 |
| GHSA-ccp5-gg58-pxfm Improper Preservation of Permissions in Apache Struts |
High EPSS 66.15% |
>= 2.0.0, < 2.5.22 | 2.5.22 |
| GHSA-265r-pp83-gww7 Cross-site Scripting in Apache Struts |
Medium EPSS 5.76% |
< 2.3.20 | 2.3.20 |
| GHSA-jgcr-9c2q-rvp8 Apache Struts is vulnerable to Cross-site Scripting |
Medium EPSS 5.61% |
>= 2.0.0, < 2.0.11.1 | 2.0.11.1 |
| GHSA-jgcr-9c2q-rvp8 Apache Struts is vulnerable to Cross-site Scripting |
Medium EPSS 5.61% |
>= 2.1.0, < 2.1.1 | 2.1.1 |
| GHSA-wv7g-xhvw-8hcp Apache Struts directory traversal vulnerability |
Medium EPSS 72.71% |
>= 2.0.0, < 2.0.12 | 2.0.12 |
| GHSA-wv7g-xhvw-8hcp Apache Struts directory traversal vulnerability |
Medium EPSS 72.71% |
>= 2.1.0, < 2.1.3 | 2.1.3 |
| GHSA-56f8-g68r-j699 Cross-site Scripting in Apache Struts |
Low EPSS 33.35% |
< 2.2.3 | 2.2.3 |
| GHSA-3g8j-jj54-3vjg Apache Struts is vulnerable to Cross-site Scripting |
Medium EPSS 6.12% |
< 2.3.16 | 2.3.16 |
| GHSA-q5q8-jghf-3pm3 Apache Struts2 Broken Access Control Vulnerability |
Medium EPSS 6.52% |
< 2.3.15.3 | 2.3.15.3 |
| GHSA-2j4q-9fff-236j Apache Struts XSS Vulnerability |
Medium EPSS 7.78% |
>= 2.0.0, < 2.3.28 | 2.3.28 |
| GHSA-pvm9-288c-v5wq Remote Code Execution in Apache Struts |
Critical EPSS 19.17% |
< 2.3.20.3 | 2.3.20.3 |
| GHSA-pvm9-288c-v5wq Remote Code Execution in Apache Struts |
Critical EPSS 19.17% |
>= 2.3.28, < 2.3.28.1 | 2.3.28.1 |
| GHSA-pvm9-288c-v5wq Remote Code Execution in Apache Struts |
Critical EPSS 19.17% |
>= 2.3.24, < 2.3.24.3 | 2.3.24.3 |
| GHSA-383p-xqxx-rrmp Denial of service in Apache Struts |
Medium EPSS 8.44% |
>= 2.0.0, < 2.3.24.3 | 2.3.24.3 |
| GHSA-j7h6-xr7g-m2c5 Code injection in Apache Struts |
High EPSS 8.40% |
>= 2.0.0, < 2.3.15.2 | 2.3.15.2 |
| GHSA-rpj9-r897-wc6q Open redirect in Apache Struts |
Medium EPSS 94.65% |
< 2.3.15.1 | 2.3.15.1 |
| GHSA-xg75-68x3-7p3q Apache Struts vulnerable to possible DoS attack when using URLValidator |
Medium EPSS 10.37% |
>= 2.3.20, < 2.3.29 | 2.3.29 |
| GHSA-xg75-68x3-7p3q Apache Struts vulnerable to possible DoS attack when using URLValidator |
Medium EPSS 10.37% |
>= 2.5.0, < 2.5.13 | 2.5.13 |
| GHSA-xm92-v2mq-842q Apache Struts improper action name cleanup |
Critical EPSS 6.60% |
>= 2.5-BETA1, < 2.5.1 | 2.5.1 |
| GHSA-xm92-v2mq-842q Apache Struts improper action name cleanup |
Critical EPSS 6.60% |
>= 2.0.0, < 2.3.29 | 2.3.29 |
| GHSA-2rvh-q539-q33v Cross-Site Request Forgery in Apache Struts |
Medium EPSS 3.36% |
>= 2.0.0, < 2.3.4.1 | 2.3.4.1 |
| GHSA-q2cg-xf9p-h457 Incomplete exclude pattern in Apache Struts |
High EPSS 6.32% |
>= 2.0.0, < 2.3.20.1 | 2.3.20.1 |
| GHSA-4qgj-9mvg-3929 Special top object can be used to access Struts' internals |
High EPSS 9.06% |
< 2.3.24.1 | 2.3.24.1 |
| GHSA-86vq-8qhc-5rqw Apache Struts vulnerable to possible DoS attack when using URLValidator |
Medium EPSS 3.26% |
>= 2.5.0, < 2.5.13 | 2.5.13 |
| GHSA-h4v9-jf2r-9h6m Cross-Site Request Forgery in Apache Struts |
Medium EPSS 3.38% |
< 2.3.20 | 2.3.20 |
| GHSA-vwhv-j36g-5rm8 Cross-site Scripting in Apache Struts |
Medium EPSS 7.53% |
< 2.3.20 | 2.3.20 |
| GHSA-gqqm-564f-vvxq Arbitrary code execution in Apache Struts 2 |
High EPSS 70.21% |
>= 2.0.0, < 2.3.14.3 | 2.3.14.3 |
| GHSA-pw8r-x2qm-3h5m Arbitrary code execution in Apache Struts 2 |
High EPSS 13.83% |
>= 2.0.0, < 2.3.14.3 | 2.3.14.3 |
| GHSA-m3x6-9v6h-4g28 Cross-site Scripting in Apache Struts |
Medium EPSS 11.56% |
>= 2.0.0, < 2.3.28 | 2.3.28 |
| GHSA-mwrx-hx6x-3hhv Apache Struts Code injection due to conversion error |
High EPSS 13.69% |
< 2.2.3.1 | 2.2.3.1 |
| GHSA-864w-r5qj-h6fj Apache Struts forced double OGNL evaluation |
High EPSS 8.09% |
>= 2.0.0, < 2.3.29 | 2.3.29 |
| GHSA-prjv-jj26-wf8h ClassLoader manipulation in Apache Struts |
High EPSS 98.06% |
< 2.3.20 | 2.3.20 |
| GHSA-3c5c-xrq4-qhr8 ClassLoader manipulation in Apache Struts |
High EPSS 78.32% |
< 2.3.20 | 2.3.20 |
| GHSA-737w-mh58-cxjp Arbitrary code execution in Apache Struts |
High EPSS 73.70% |
>= 2.0.0, < 2.3.14.2 | 2.3.14.2 |
| GHSA-vrwc-qjmw-5rjm ClassLoader manipulation in Apache Struts |
Medium EPSS 99.39% |
>= 2.0.0, < 2.3.16.2 | 2.3.16.2 |
| GHSA-whmq-v94q-34p9 Improper Control of Generation of Code in Apache Struts |
High EPSS 93.53% |
< 2.3.14.3 | 2.3.14.3 |
| GHSA-8c6j-ffmf-q6vm Apache Struts RCE Vulnerability Known exploited |
High EPSS 96.53% |
>= 2.3.21, < 2.3.24.3 | 2.3.24.3 |
| GHSA-8c6j-ffmf-q6vm Apache Struts RCE Vulnerability Known exploited |
High EPSS 96.53% |
>= 2.3.19, < 2.3.20.3 | 2.3.20.3 |
| GHSA-mmj6-cjj4-hpr5 Apache Struts vulnerable to arbitrary remote code execution due to improper input validation |
Critical EPSS 81.87% |
>= 2.3.19, < 2.3.20.3 | 2.3.20.3 |
| GHSA-mmj6-cjj4-hpr5 Apache Struts vulnerable to arbitrary remote code execution due to improper input validation |
Critical EPSS 81.87% |
>= 2.3.21, < 2.3.24.3 | 2.3.24.3 |
| GHSA-mmj6-cjj4-hpr5 Apache Struts vulnerable to arbitrary remote code execution due to improper input validation |
Critical EPSS 81.87% |
>= 2.3.25, < 2.3.28.1 | 2.3.28.1 |
| GHSA-hmhq-382q-mp56 ClassLoader manipulation in Apache Struts |
High EPSS 6.57% |
< 2.3.20 | 2.3.20 |
| GHSA-8c6j-ffmf-q6vm Apache Struts RCE Vulnerability Known exploited |
High EPSS 96.53% |
>= 2.3.25, < 2.3.28.1 | 2.3.28.1 |
| GHSA-4prj-vw9j-v6pr Arbitrary code execution in Apache Struts 2 |
Critical EPSS 16.74% |
>= 2.3.19, < 2.3.29 | 2.3.29 |
| GHSA-876p-4wgc-75rx Apache Struts RCE Vulnerability |
High EPSS 8.88% |
>= 2.3.24, < 2.3.24.3 | 2.3.24.3 |
| GHSA-876p-4wgc-75rx Apache Struts RCE Vulnerability |
High EPSS 8.88% |
>= 2.0.0, < 2.3.20.3 | 2.3.20.3 |
| GHSA-7ghm-rpc7-p7g5 Code injection in Apache Struts |
High EPSS 74.64% |
>= 2.0.0, < 2.3.14.2 | 2.3.14.2 |
| GHSA-x5fc-pgpx-59j5 Server side object manipulation in Apache Struts |
Medium EPSS 92.02% |
< 2.2.1 | 2.2.1 |
| GHSA-47qp-8v9g-39hp Code injection in Apache Struts Known exploited |
Critical EPSS 100.00% |
< 2.3.15.1 | 2.3.15.1 |
| GHSA-47qp-8v9g-39hp Code injection in Apache Struts Known exploited |
Critical EPSS 100.00% |
< 2.3.15.1 | 2.3.15.1 |
| GHSA-4wrr-9h5r-m92w Apache Struts Remote Java Code Execution Known exploited |
Critical EPSS 75.60% |
< 2.2.3.1 | 2.2.3.1 |
| GHSA-hxqq-w4mr-mc62 Apache Struts's ParameterInterceptor component does not prevent access to public constructors |
Medium EPSS 36.32% |
< 2.3.1.1 | 2.3.1.1 |
| GHSA-4wrr-9h5r-m92w Apache Struts Remote Java Code Execution Known exploited |
Critical EPSS 75.60% |
< 2.2.3.1 | 2.2.3.1 |
| GHSA-2ppp-xj34-vvf7 Apache Struts's CookieInterceptor component does not use the parameter-name whitelist |
Medium EPSS 97.53% |
< 2.2.3.1 | 2.2.3.1 |
| GHSA-8m5q-crqq-6pmf Unrestricted Upload of File with Dangerous Type in Apache Struts2 |
High EPSS 28.55% |
>= 2.0, < 2.5.22 | 2.5.22 |
| GHSA-j68f-8h6p-9h5q Struts ParameterInterceptor vulnerability allows remote command execution |
Critical EPSS 89.49% |
>= 2.0.0, < 2.3.1.2 | 2.3.1.2 |
| GHSA-v8j6-6c2r-r27c Expression Language Injection in Apache Struts |
Critical EPSS 85.43% |
>= 2.0.0, < 2.5.30 | 2.5.30 |
| GHSA-wp4h-pvgw-5727 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts |
Critical EPSS 96.95% |
>= 2.0.0, < 2.5.22 | 2.5.22 |
| CVE-2020-17530 Remote code execution in Apache Struts Known exploited |
Critical EPSS 96.25% |
>= 2.0.0, < 2.5.26 | 2.5.26 |
| CVE-2020-17530 Remote code execution in Apache Struts Known exploited |
Critical EPSS 96.25% |
>= 2.0.0, < 2.5.26 | 2.5.26 |
| GHSA-j77q-2qqg-6989 Apache Struts vulnerable to remote arbitrary command execution due to improper input validation Known exploited |
Critical EPSS 100.00% |
>= 2.5.0, <= 2.5.10 | No fix yet |
| GHSA-j77q-2qqg-6989 Apache Struts vulnerable to remote arbitrary command execution due to improper input validation Known exploited |
Critical EPSS 100.00% |
>= 2.3.0, <= 2.3.31 | No fix yet |
| GHSA-j77q-2qqg-6989 Apache Struts vulnerable to remote arbitrary command execution due to improper input validation Known exploited |
Critical EPSS 100.00% |
>= 2.5.0, < 2.5.10.1 | 2.5.10.1 |
| GHSA-j77q-2qqg-6989 Apache Struts vulnerable to remote arbitrary command execution due to improper input validation Known exploited |
Critical EPSS 100.00% |
>= 2.3.0, < 2.3.32 | 2.3.32 |
| GHSA-x5x7-3v85-wpc4 Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used |
High EPSS 8.24% |
>= 2.5.0, < 2.5.13 | 2.5.13 |
| GHSA-x5x7-3v85-wpc4 Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used |
High EPSS 8.24% |
>= 2.3.7, < 2.3.34 | 2.3.34 |
| GHSA-8mr5-h28g-36qx Spring AOP functionality (Struts) vulnerable to DoS attack |
High EPSS 10.55% |
>= 2.5.0, < 2.5.12 | 2.5.12 |
| GHSA-8mr5-h28g-36qx Spring AOP functionality (Struts) vulnerable to DoS attack |
High EPSS 10.55% |
>= 2.3.7, < 2.3.33 | 2.3.33 |
| GHSA-9gp7-jvm2-r4mx Apache Struts Improper Input Validation vulnerability |
Medium EPSS 9.84% |
>= 2.5.0, < 2.5.12 | 2.5.12 |
| GHSA-8fx9-5hx8-crhm Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal |
Critical EPSS 87.12% |
>= 2.5.0, < 2.5.11 | 2.5.11 |
| GHSA-8fx9-5hx8-crhm Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal |
Critical EPSS 87.12% |
>= 2.0.1, < 2.3.34 | 2.3.34 |
| CVE-2018-11776 Apache Struts vulnerable to remote command execution (RCE) due to improper input validation Known exploited |
High EPSS 100.00% |
>= 2.0.4, <= 2.3.34 | No fix yet |
| CVE-2018-11776 Apache Struts vulnerable to remote command execution (RCE) due to improper input validation Known exploited |
High EPSS 100.00% |
>= 2.5, <= 2.5.16 | No fix yet |
| CVE-2018-11776 Apache Struts vulnerable to remote command execution (RCE) due to improper input validation Known exploited |
High EPSS 100.00% |
>= 2.5, < 2.5.17 | 2.5.17 |
| CVE-2018-11776 Apache Struts vulnerable to remote command execution (RCE) due to improper input validation Known exploited |
High EPSS 100.00% |
>= 2.0.4, < 2.3.35 | 2.3.35 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor