WaratekVRT Sign in
Reset
More filters (1)
Columns
Product: Struts✕
Overview 5 matches · 0 protected · 0 CISA KEV
5matches 0protected0.0% 0CISA KEV0.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 5 100.0% No exploit published 0 0.0%
Critical 2 40.0% High 2 40.0% Medium 1 20.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 5 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 5 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Mitigation candidate: 5 Medium: 1High: 2Critical: 2 not blocked: 5 Exploited: 5
20131 Mitigation candidate1 High1 not blocked1 Exploited1 20142 Mitigation candidate2 High1 Medium1 not blocked2 Exploited2 20150 20160 20170 20180 20191 Mitigation candidate1 Critical1 not blocked1 Exploited1 20200 20210 20220 20231 Mitigation candidate1 Critical1 not blocked1 Exploited1
20132014201520162017201820192020202120222023
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-50164 Critical 2023-12-07 Mitigation candidate Exploited An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
CVE-2011-3923 Critical 2019-11-01 Mitigation candidate Exploited Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
CVE-2014-0113 High 2014-04-29 Mitigation candidate Exploited CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
CVE-2014-0094 Medium 2014-03-11 Mitigation candidate Exploited The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.
CVE-2013-2134 High 2013-07-16 Mitigation candidate Exploited Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.