org.apache.struts CVEs · Mitigation candidate · Critical

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 3 matches · 0 protected · 2 exploited · 0 CISA KEV

3matches 0protected0.0% 2exploited66.7% 0CISA KEV0.0%

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 3 100.0% No exploit published 0 0.0%

Critical 3 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 3 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 2 66.7% Working exploit published 1 33.3% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%

split by StatusSeverityProtectionExploit maturity peak 1 / year

20161 Mitigation candidate1 Critical1 not blocked1 Working exploit published1 20170 20180 20191 Mitigation candidate1 Critical1 not blocked1 Exploited1 20200 20210 20220 20231 Mitigation candidate1 Critical1 not blocked1 Exploited1

20162017201820192020202120222023

3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2023-50164	Critical	2023-12-07	Mitigation candidate	Exploited	An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
CVE-2011-3923	Critical	2019-11-01	Mitigation candidate	Exploited	Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
CVE-2016-3087	Critical	2016-06-07	Mitigation candidate	Working exploit published	Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2023-50164

Critical

2023-12-07

Mitigation candidate

Exploited

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

CVE-2011-3923

Critical

2019-11-01

Mitigation candidate

Exploited

Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.

CVE-2016-3087

Critical

2016-06-07

Mitigation candidate

Working exploit published

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.