org.apache.struts.xwork CVEs · No exploit published

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 3 matches · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5

3matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 3 100.0%

Critical 0 0.0% High 1 33.3% Medium 2 66.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 3 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 100.0%

split by StatusSeverityProtectionExploit maturity peak 1 / month

May 111 No exploit published1 Medium1 not blocked1 No public exploit1 Jun 110 Jul 110 Aug 110 Sep 110 Oct 110 Nov 110 Dec 110 Jan 120 Feb 120 Mar 121 No exploit published1 High1 not blocked1 No public exploit1 Apr 120 May 120 Jun 120 Jul 120 Aug 120 Sep 121 No exploit published1 Medium1 not blocked1 No public exploit1

May 11Jul 11Sep 11Nov 11Jan 12Mar 12May 12Jul 12Sep 12

3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2012-4387	Medium	2012-09-05	No exploit published	No public exploit	Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
CVE-2012-0838	High	2012-03-02	No exploit published	No public exploit	Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
CVE-2011-2088	Medium	2011-05-13	No exploit published	No public exploit	XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2012-4387

Medium

2012-09-05

No exploit published

No public exploit

Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.

CVE-2012-0838

High

2012-03-02

No exploit published

No public exploit

Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.

CVE-2011-2088

Medium

2011-05-13

No exploit published

No public exploit

XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.