WaratekVRT Sign in
Reset
More filters (3)
Columns
Protection: None✕Published from 2017-12-01✕Vendor org.apache.struts✕
Overview 12 matches · 0 protected · 2 exploited · 0 CISA KEV · 3 public PoC · 3 EPSS ≥ 0.5
12matches 0protected0.0% 2exploited16.7% 0CISA KEV0.0% 3public PoC25.0% 3EPSS ≥ 0.525.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 3 25.0% No exploit published 9 75.0%
Critical 2 16.7% High 6 50.0% Medium 4 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 12 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 16.7% Working exploit published 1 8.3% Proof of concept only 0 0.0% Forecast only 1 8.3% No public exploit 8 66.7%
split by peak 4 / year
No exploit published: 9Mitigation candidate: 3 Medium: 4High: 6Critical: 2 not blocked: 12 No public exploit: 8Forecast only: 1Working exploit published: 1Exploited: 2
20171 No exploit published1 Medium1 not blocked1 No public exploit1 20180 20192 Mitigation candidate2 Critical1 High1 not blocked2 Exploited1 Working exploit published1 20202 No exploit published2 High1 Medium1 not blocked2 Forecast only1 No public exploit1 20210 20220 20234 Mitigation candidate1 No exploit published3 Critical1 High2 Medium1 not blocked4 Exploited1 No public exploit3 20240 20253 No exploit published3 High2 Medium1 not blocked3 No public exploit3
201720182019202020212022202320242025
12 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-66675 High 2025-12-10 No exploit published No public exploit Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue. It's related to  https://cve.org/CVERecord?id=CVE-2025-64775  - this CVE addresses missing affected version 6.7.4
CVE-2025-64775 High 2025-12-01 No exploit published No public exploit Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
CVE-2025-54656 Medium 2025-07-30 No exploit published No public exploit ** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts. This issue affects Apache Struts Extras: before 2. When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output where part of the message masquerades as a separate log line, confusing consumers of the logs (either human or automated).  As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2023-50164 Critical 2023-12-07 Mitigation candidate Exploited An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
CVE-2023-41835 High 2023-12-05 No exploit published No public exploit When a Multipart request is performed but some of the fields exceed the maxStringLength  limit, the upload files will remain in struts.multipart.saveDir  even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.
CVE-2023-34396 High 2023-06-14 No exploit published No public exploit Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater
CVE-2023-34149 Medium 2023-06-14 No exploit published No public exploit Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater.
CVE-2019-0233 High 2020-09-14 No exploit published Forecast only An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.
CVE-2015-2992 Medium 2020-02-27 No exploit published No public exploit Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
CVE-2012-1592 High 2019-12-05 Mitigation candidate Working exploit published A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
CVE-2011-3923 Critical 2019-11-01 Mitigation candidate Exploited Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
CVE-2017-15707 Medium 2017-12-01 No exploit published No public exploit In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.