CVE-2015-1831
published 2015-07-16CVE-2015-1831: The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified…
PriorityP343high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
6.31%
92.9th percentile
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | struts | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Incomplete exclude pattern in Apache Struts
ghsa·2022-05-17
CVE-2015-1831 [HIGH] Incomplete exclude pattern in Apache Struts
Incomplete exclude pattern in Apache Struts
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. In Struts 2.3.20.1 a better set of exlude patterns was defined.
OSV
Incomplete exclude pattern in Apache Struts
osv·2022-05-17
CVE-2015-1831 [HIGH] Incomplete exclude pattern in Apache Struts
Incomplete exclude pattern in Apache Struts
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. In Struts 2.3.20.1 a better set of exlude patterns was defined.
Red Hat
struts2: incorrect default exclude patterns
vendor_redhat·2015-05-11·CVSS 7.5
CVE-2015-1831 [HIGH] struts2: incorrect default exclude patterns
struts2: incorrect default exclude patterns
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.
Statement: A previous statement by Red Hat related to this CVE, prior to August 2019, said that Apache Struts 2 is not included in any Red Hat products. This earlier statement was incorrect. While Struts 2 is not actively compiled, shipped, used, or enabled in any Red Hat provided final products, and does not cause any vulnerability in the product, struts2-core jars have been included in some products' source code packages. The inclusion was part of an import of the Google Guice repository, which includes struts2-core. Customers that build artefacts from our source code could be at
No detection rules found.
No public exploits indexed.
2015-07-16
Published