WaratekVRT Sign in
Reset
More filters (3)
Columns
Published from 2017-01-01✕Published to 2017-12-31✕Vendor org.apache.struts✕
Overview 15 matches · 5 protected · 4 exploited · 3 CISA KEV · 4 public PoC · 4 EPSS ≥ 0.5
15matches 5protected33.3% 4exploited26.7% 3CISA KEV20.0% 4public PoC26.7% 4EPSS ≥ 0.526.7%
Protected by Waratek 5 33.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 10 66.7%
Critical 4 26.7% High 7 46.7% Medium 4 26.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 33.3% partly blocked 0 0.0% not blocked 10 66.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 26.7% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 11 73.3%
split by peak 7 / month
No exploit published: 10Protected by Waratek: 5 Medium: 4High: 7Critical: 4 not blocked: 10blocked by ARMR today: 5 No public exploit: 11Exploited: 4
Mar 171 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 Apr 170 May 170 Jun 170 Jul 173 Protected by Waratek1 No exploit published2 Critical1 High1 Medium1 blocked by ARMR today1 not blocked2 Exploited1 No public exploit2 Aug 171 No exploit published1 High1 not blocked1 No public exploit1 Sep 177 Protected by Waratek3 No exploit published4 Critical2 High3 Medium2 blocked by ARMR today3 not blocked4 Exploited2 No public exploit5 Oct 172 No exploit published2 High2 not blocked2 No public exploit2 Nov 170 Dec 171 No exploit published1 Medium1 not blocked1 No public exploit1
Mar 17Apr 17May 17Jun 17Jul 17Aug 17Sep 17Oct 17Nov 17Dec 17
15 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2017-15707 Medium 2017-12-01 No exploit published No public exploit In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.
CVE-2016-3090 High 2017-10-30 No exploit published No public exploit The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.
CVE-2016-4461 High 2017-10-16 No exploit published No public exploit Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785.
CVE-2015-5169 Medium 2017-09-25 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
CVE-2017-9804 High 2017-09-20 No exploit published No public exploit In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
CVE-2017-9793 High 2017-09-20 No exploit published No public exploit The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
CVE-2017-12611 Critical 2017-09-20 Protected by Waratek Exploited In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
CVE-2016-8738 Medium 2017-09-20 No exploit published No public exploit In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.
CVE-2016-6795 Critical 2017-09-20 Protected by Waratek No public exploit In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.
CVE-2017-9805 High 2017-09-15 Protected by Waratek Exploited The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
CVE-2015-5209 High 2017-08-29 No exploit published No public exploit Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object.
CVE-2017-9787 High 2017-07-13 No exploit published No public exploit When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.
CVE-2017-7672 Medium 2017-07-13 No exploit published No public exploit If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.
CVE-2017-9791 Critical 2017-07-10 Protected by Waratek Exploited The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
CVE-2017-5638 Critical 2017-03-11 Protected by Waratek Exploited The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.