Vulnerabilidades do Maven Org.apache.struts:struts2-core
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Maven Org.apache.struts:struts2-core: 7 registro(s), com versões afetadas e correções.
CVE-2025-66675
Alta · 8.2
CWE-459 10/12/2025
Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.
Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
It's related to https://cve.org/CVERecord?id=CVE-2025-64775 - this CVE addresses missing affected version 6.7.4
CVE-2025-64775
Alta · 7.5
CWE-459 01/12/2025
Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.
Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
CVE-2020-17530
Crítica · 9.8
KEV Urgente · 79 Exploit público CWE-917 10/12/2020
Apache Struts Remote Code Execution Vulnerability
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
CVE-2018-11776
Alta · 8.1
KEV Urgente · 76 Exploit público 22/08/2018
Apache Struts Remote Code Execution Vulnerability
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
CVE-2017-5638
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-755 10/03/2017
Apache Struts Remote Code Execution Vulnerability
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
CVE-2016-3081
Alta · 8.1
KEV Urgente · 76 Exploit público CWE-77 26/04/2016
Apache Struts Command Injection Vulnerability
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
CVE-2012-0391
Crítica · 9.8
KEV Urgente · 83 Exploit público CWE-94 08/01/2012
Apache Struts 2 Improper Input Validation Vulnerability
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.