Struts Apache Struts

Do you want an email whenever new security vulnerabilities are reported in Apache Struts?

By the Year

In 2022 there have been 1 vulnerability in Apache Struts with an average score of 9.8 out of ten. Struts did not have any published security vulnerabilities last year. That is, 1 more vulnerability have already been reported in 2022 as compared to last year.

Year Vulnerabilities Average Score
2022 1 9.80
2021 0 0.00
2020 4 8.30
2019 1 8.80
2018 3 8.47

It may take a day or so for new Struts vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Apache Struts Security Vulnerabilities

The fix issued for CVE-2020-17530 was incomplete

CVE-2021-31805 9.8 - Critical - April 12, 2022

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tags attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.

EL Injection

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution

CVE-2020-17530 9.8 - Critical - December 11, 2020

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

EL Injection

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation

CVE-2019-0230 9.8 - Critical - September 14, 2020

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Mass Assignment

An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.

CVE-2019-0233 7.5 - High - September 14, 2020

An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.

Improper Preservation of Permissions

Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.

CVE-2015-2992 6.1 - Medium - February 27, 2020

Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.

XSS

A local code execution issue exists in Apache Struts2 when processing malformed XSLT files

CVE-2012-1592 8.8 - High - December 05, 2019

A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.

Unrestricted File Upload

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer

CVE-2018-11776 8.1 - High - August 22, 2018

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

Improper Input Validation

The Apache Struts REST Plugin is using XStream library which is vulnerable and

CVE-2018-1327 7.5 - High - March 27, 2018

The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could

CVE-2017-7525 9.8 - Critical - February 06, 2018

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Denylist / Deny List

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might

CVE-2017-9791 9.8 - Critical - July 10, 2017

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

Improper Input Validation

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which

CVE-2017-5638 10 - Critical - March 11, 2017

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Improper Input Validation

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which

CVE-2016-1181 8.1 - High - July 04, 2016

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which

CVE-2016-1182 8.2 - High - July 04, 2016

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

Improper Input Validation

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which

CVE-2014-0114 - April 30, 2014

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

Improper Input Validation

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header

CVE-2012-0392 - January 08, 2012

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used

CVE-2012-0394 - January 08, 2012

** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."

Code Injection

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Apache Struts or by Apache? Click the Watch button to subscribe.

Apache
Vendor

Apache Struts
Product

subscribe