ST
Web Framework
Struts
On CISA KEVExploited in the wildRansomware-linked
99
CVEs
9
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 17High 32Medium 14Low 0
Watch
Add Struts to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-17530 In wildKEV | 9.8 | Dec 11 | Apache Struts Remote Code Execution Vulnerability Affected: Struts 2.0.0 - Struts 2.5.25 |
| CVE-2017-9791 In wildKEV | 9.8 | Jul 10 | The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage Affected: 2.1.x series; 2.3.x series |
| CVE-2017-5638 RansomwareIn wildKEV | 9.8 | Mar 11 | The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload… Affected: 2.3.x before 2.3.32; 2.5.x before 2.5.10.1 |
| CVE-2013-2251 In wildKEV | 9.8 | Jul 18 | Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction:… Affected: 2.0.0 through 2.3.15 |
| CVE-2012-0391 In wildKEV | 9.8 | Jan 8 | The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of… Affected: before 2.2.3.1 |
Showing 5