Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Struts

33 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.8
    CVE-2020-17530 Exploited Public exploit EPSS 96%

    Remote code execution in Apache Struts

    Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
    KEV Nov 3, 2021
  • High 8.1
    CVE-2018-11776 Exploited Public exploit EPSS 100%

    Apache Struts vulnerable to remote command execution (RCE) due to improper input validation

    Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upp…

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
    KEV Nov 3, 2021
  • High 8.1
    CVE-2017-9805 Exploited Public exploit EPSS 99%

    REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering

    The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloa…

    Apache Software Foundation Apache Struts org.apache.struts:struts2-rest-plugin Maven
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2017-9791 Exploited Public exploit EPSS 99%

    Code execution in Apache Struts 1 plugin

    The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

    Apache Software Foundation Apache Struts org.apache.struts:struts2-struts1-plugin Maven
    KEV Feb 10, 2022
  • Critical 9.8
    CVE-2017-5638 Exploited · Ransomware Public exploit EPSS 100%

    Apache Struts vulnerable to remote arbitrary command execution due to improper input validation

    The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted …

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
    KEV Nov 3, 2021