Apache Struts vulnerabilities

CVE-2012-1006 [MEDIUM] CWE-79 CVE-2012-1006: Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote a Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders.

CVE-2013-2135 [CRITICAL] CWE-94 CVE-2013-2135: Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.

CVE-2016-3090 [HIGH] CWE-20 CVE-2016-3090: The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attacke The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.

CVE-2015-0899 [HIGH] CWE-20 CVE-2015-0899: The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.

CVE-2016-0785 [HIGH] CWE-20 CVE-2016-0785: Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequen Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.

CVE-2016-4461 [HIGH] CVE-2016-4461: Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequen Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785.

CVE-2012-0838 [CRITICAL] CWE-20 CVE-2012-0838: Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a con Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.

CVE-2012-1007 [MEDIUM] CWE-79 CVE-2012-1007: Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers t Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or (3) struts-cookbook/processDyna.do.

CVE-2016-1181 [HIGH] CVE-2016-1181: ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an Actio ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

CVE-2016-4431 [HIGH] CWE-20 CVE-2016-4431: Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictio Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.

CVE-2016-4433 [HIGH] CWE-20 CVE-2016-4433: Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictio Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.

CVE-2016-1182 [HIGH] CVE-2016-1182: ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator co ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

CVE-2016-4436 [CRITICAL] CVE-2016-4436: Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.

CVE-2023-41835 [HIGH] CWE-459 CVE-2023-41835: When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.

CVE-2005-3745 [MEDIUM] CVE-2005-3745: Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.

CVE-2015-5209 [HIGH] CWE-20 CVE-2015-5209: Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object.

CVE-2017-9793 [HIGH] CWE-20 CVE-2017-9793: The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outd The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.

CVE-2011-1772 [LOW] CWE-79 CVE-2011-1772: Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.

CVE-2018-1327 [HIGH] CVE-2018-1327: The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS a The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option

CVE-2025-66675 [HIGH] CVE-2025-66675: Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes d Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue. It's related to https://cve.org/CVERecord?id=CVE-2025-64775 - this CVE ad