Apache Struts
By the Year
In 2022 there have been 1 vulnerability in Apache Struts with an average score of 9.8 out of ten. Struts did not have any published security vulnerabilities last year. That is, 1 more vulnerability have already been reported in 2022 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2022 | 1 | 9.80 |
| 2021 | 0 | 0.00 |
| 2020 | 4 | 8.30 |
| 2019 | 1 | 8.80 |
| 2018 | 3 | 8.47 |
It may take a day or so for new Struts vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apache Struts Security Vulnerabilities
The fix issued for CVE-2020-17530 was incomplete
CVE-2021-31805
9.8 - Critical
- April 12, 2022
The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tags attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.
EL Injection
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution
CVE-2020-17530
9.8 - Critical
- December 11, 2020
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
EL Injection
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation
CVE-2019-0230
9.8 - Critical
- September 14, 2020
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
Mass Assignment
An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.
CVE-2019-0233
7.5 - High
- September 14, 2020
An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.
Improper Preservation of Permissions
Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
CVE-2015-2992
6.1 - Medium
- February 27, 2020
Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
XSS
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files
CVE-2012-1592
8.8 - High
- December 05, 2019
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
Unrestricted File Upload
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer
CVE-2018-11776
8.1 - High
- August 22, 2018
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
Improper Input Validation
The Apache Struts REST Plugin is using XStream library which is vulnerable and
CVE-2018-1327
7.5 - High
- March 27, 2018
The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could
CVE-2017-7525
9.8 - Critical
- February 06, 2018
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
Denylist / Deny List
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might
CVE-2017-9791
9.8 - Critical
- July 10, 2017
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Improper Input Validation
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which
CVE-2017-5638
10 - Critical
- March 11, 2017
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
Improper Input Validation
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which
CVE-2016-1181
8.1 - High
- July 04, 2016
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which
CVE-2016-1182
8.2 - High
- July 04, 2016
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.
Improper Input Validation
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which
CVE-2014-0114
- April 30, 2014
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Improper Input Validation
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header
CVE-2012-0392
- January 08, 2012
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used
CVE-2012-0394
- January 08, 2012
** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."
Code Injection
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Apache Struts or by Apache? Click the Watch button to subscribe.
