ST
Web Framework
Struts
On CISA KEVExploited in the wildRansomware-linked
99
CVEs
9
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 17High 32Medium 14Low 0
Watch
Add Struts to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-17530 In wildKEV | 9.8 | Dec 11 | Apache Struts Remote Code Execution Vulnerability Affected: Struts 2.0.0 - Struts 2.5.25 |
| CVE-2017-9791 In wildKEV | 9.8 | Jul 10 | The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage Affected: 2.1.x series; 2.3.x series |
| CVE-2017-5638 RansomwareIn wildKEV | 9.8 | Mar 11 | The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload… Affected: 2.3.x before 2.3.32; 2.5.x before 2.5.10.1 |
| CVE-2013-2251 In wildKEV | 9.8 | Jul 18 | Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction:… Affected: 2.0.0 through 2.3.15 |
| CVE-2012-0391 In wildKEV | 9.8 | Jan 8 | The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of… Affected: before 2.2.3.1 |
| CVE-2026-104711 | 9.8 | Oct 5 | Apache Struts: OGNL injection in the legacy RESTful action mapper Affected: 2.0.0 through 2.3.37; 2.5.0 through 2.5.33; 6.0.0 through 6.11.0; 7.0.0 through 7.3.0 |
| CVE-2024-53677 | 9.8 | Dec 11 | File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a… Affected: 2.0.0 before 6.4.0 |
| CVE-2023-50164 | 9.8 | Dec 7 | An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform… Affected: 2.0.0 before 2.5.33; 6.0.0 before 6.3.0.2 |
| CVE-2021-31805 | 9.8 | Apr 12 | The fix issued for CVE-2020-17530 was incomplete Affected: 2.0.0 through 2.5.29 |
| CVE-2019-0230 | 9.8 | Sep 14 | Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution Affected: 2.0.0 through 2.5.20 |
| CVE-2011-3923 | 9.8 | Nov 1 | Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands Affected: 2.0.0 before 2.3.1.2 |
| CVE-2017-12611 | 9.8 | Sep 20 | In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack Affected: 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6; +34 more |
| CVE-2016-6795 | 9.8 | Sep 20 | In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution… Affected: 2.3.20; 2.3.20.1; 2.3.20.2; 2.3.20.3; 2.3.21; 2.3.22; +12 more |
| CVE-2016-4436 | 9.8 | Oct 3 | Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2016-4438 | 9.8 | Jul 4 | The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression Affected: 2.3.20; 2.3.20.1; 2.3.20.3; 2.3.24; 2.3.24.1; 2.3.24.3; +1 more |
| CVE-2016-3087 | 9.8 | Jun 7 | Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors… Affected: 2.3.20; 2.3.20.1; 2.3.24; 2.3.24.1; 2.3.28 |
| CVE-2016-3082 | 9.8 | Apr 26 | XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
Showing 17