WaratekVRT Sign in

High Org.apache.struts CVEs with a working exploit

3 CVEs

Reset
More filters (1)
Columns
Vendor org.apache.struts✕
Overview 3 matches · 0 protected · 0 exploited · 0 CISA KEV · 2 EPSS ≥ 0.5
3matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 2EPSS ≥ 0.566.7%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 3 100.0% No exploit published 0 0.0%
Critical 0 0.0% High 3 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 3 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 3 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Mitigation candidate: 3 High: 3 not blocked: 3 Working exploit published: 3
20132 Mitigation candidate2 High2 not blocked2 Working exploit published2 20140 20150 20160 20170 20180 20191 Mitigation candidate1 High1 not blocked1 Working exploit published1
2013201420152016201720182019
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2012-1592 High 2019-12-05 Mitigation candidate Working exploit published A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
CVE-2013-2115 High 2013-07-10 Mitigation candidate Working exploit published Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
CVE-2013-1966 High 2013-07-10 Mitigation candidate Working exploit published Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.