Apache Struts vulnerabilities

CVE-2017-9787 [HIGH] CVE-2017-9787: When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attac When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.

CVE-2013-4310 [MEDIUM] CWE-264 CVE-2013-4310: Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix.

CVE-2017-9804 [HIGH] CVE-2017-9804: In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a UR In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-76

CVE-2015-1831 [HIGH] CVE-2015-1831: The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "comp The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.

CVE-2013-4316 [CRITICAL] CWE-16 CVE-2013-4316: Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.

CVE-2025-64775 [HIGH] CWE-459 CVE-2025-64775: Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes d Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.

CVE-2023-34396 [HIGH] CWE-770 CVE-2023-34396: Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apa Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater

CVE-2016-4430 [HIGH] CWE-352 CVE-2016-4430: Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers t Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.

CVE-2014-7809 [MEDIUM] CWE-352 CVE-2014-7809: Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows rem Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable values, which allows remote attackers to bypass the CSRF protection mechanism.

CVE-2006-1546 [HIGH] CVE-2006-1546: Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation vi Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.

CVE-2017-7672 [MEDIUM] CWE-20 CVE-2017-7672: If an application allows enter an URL in a form field and built-in URLValidator is used, it is possi If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.

CVE-2023-34149 [MEDIUM] CWE-770 CVE-2023-34149: Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apa Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater.

CVE-2014-0116 [MEDIUM] CVE-2014-0116: CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, doe CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.

CVE-2016-3093 [MEDIUM] CWE-20 CVE-2016-3093: Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL b Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.

CVE-2016-4003 [MEDIUM] CWE-79 CVE-2016-4003: Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Ap Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.

CVE-2015-5169 [MEDIUM] CWE-79 CVE-2015-5169: Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20. Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.

CVE-2016-8738 [MEDIUM] CWE-20 CVE-2016-8738: In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.

CVE-2016-2162 [MEDIUM] CWE-79 CVE-2016-2162: Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInter Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.

CVE-2015-2992 [MEDIUM] CWE-79 CVE-2015-2992: Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability. Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.

CVE-2017-15707 [MEDIUM] CWE-20 CVE-2017-15707: In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulne In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.