WaratekVRT Sign in
Reset
More filters (2)
Columns
Protection: None✕Vendor org.apache.struts✕
Overview 6 matches · 0 protected · 2 exploited · 0 CISA KEV · 3 public PoC · 3 EPSS ≥ 0.5
6matches 0protected0.0% 2exploited33.3% 0CISA KEV0.0% 3public PoC50.0% 3EPSS ≥ 0.550.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 3 50.0% No exploit published 3 50.0%
Critical 6 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 6 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 33.3% Working exploit published 1 16.7% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 50.0%
split by peak 4 / year
No exploit published: 3Mitigation candidate: 3 Critical: 6 not blocked: 6 No public exploit: 3Working exploit published: 1Exploited: 2
20164 Mitigation candidate1 No exploit published3 Critical4 not blocked4 Working exploit published1 No public exploit3 20170 20180 20191 Mitigation candidate1 Critical1 not blocked1 Exploited1 20200 20210 20220 20231 Mitigation candidate1 Critical1 not blocked1 Exploited1
20162017201820192020202120222023
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-50164 Critical 2023-12-07 Mitigation candidate Exploited An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
CVE-2011-3923 Critical 2019-11-01 Mitigation candidate Exploited Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
CVE-2016-4436 Critical 2016-10-03 No exploit published No public exploit Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.
CVE-2016-4438 Critical 2016-07-04 No exploit published No public exploit The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.
CVE-2016-3087 Critical 2016-06-07 Mitigation candidate Working exploit published Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
CVE-2016-3082 Critical 2016-04-26 No exploit published No public exploit XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.