Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
58 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
Recommended action: Upgrade to 2.5.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
Recommended action: Upgrade to 2.5.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Struts contains a Remote Code Execution when using results with no namespace and it's upper actions have no or wildcard namespace. The same flaw exists when using a url tag with no value, action set, and it's upper actions have no or wildcard namespace.
Recommended action: Upgrade to 2.5.17 or 2.3.35 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache Struts versions prior to 2.3.32 and 2.5.10.1 contain incorrect exception handling and error-message generation during file-upload attempts using the Jakarta Multipart parser, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
Recommended action: Upgrade to 2.5.10.1 or 2.3.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
Recommended action: Upgrade to 2.5.13 or 2.3.34 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.
Recommended action: Upgrade to 2.5.12 or 2.3.33 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.
Recommended action: Upgrade to 2.5.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Apache Struts 2.0.1 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
Recommended action: Upgrade to 2.5.11 or 2.3.34 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.