Skip to content
OpenAdvisories

Package · Maven

org.apache.struts.xwork:xwork-core

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium —
    CVE-2014-0094 Public exploit EPSS 99%

    ClassLoader manipulation in Apache Struts

    The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • Medium —
    CVE-2012-0394 Public exploit EPSS 73%

    Apache Struts's DebuggingInterceptor component allows remote code execution in developer mode

    The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itsel…

    org.apache.struts.xwork:xwork-core Maven
  • Medium —
    CVE-2012-0392 Public exploit EPSS 98%

    Apache Struts's CookieInterceptor component does not use the parameter-name whitelist

    The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • Medium —
    CVE-2012-0393 Public exploit EPSS 36%

    Apache Struts's ParameterInterceptor component does not prevent access to public constructors

    The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven