CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Apache Struts 2 Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2018-11776)
[Affected Scope] Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16
[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with system privileges via crafted HTTP requests
[Mitigation] Immediately upgrade Apache Struts to patched versions (2.3.35, 2.5.17, or higher) and review namespace configurations.
Apache Struts 2 Struts 1 Plugin Remote Code Execution Vulnerability (CVE-2017-9791, S2-048) Analysis and Mitigation Guide
[Affected Scope] Web applications running Apache Struts 2.1.x and 2.3.x that utilize the Struts 1 integration plugin (struts2-struts1-plugin)
[Impact] Unauthenticated remote attackers can execute arbitrary system commands under the privileges of the web server, leading to complete system compromise
[Mitigation] Upgrade to the latest supported Apache Struts 2.5.x+ versions, or completely disable and remove the struts2-struts1-plugin dependency
Apache Struts 2 Jakarta Multipart Parser Remote Code Execution (RCE) Vulnerability (CVE-2017-5638) Analysis and Mitigation Guide
[Affected Scope] Web applications built on Apache Struts 2.3.x (before 2.3.32) and 2.5.x (before 2.5.10.1)
[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with system privileges via crafted HTTP headers such as Content-Type
[Mitigation] Immediately upgrade Apache Struts to a secure version (2.3.32, 2.5.10.1, or higher) and apply WAF rules to block malicious OGNL payloads
Apache Struts 2 Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2013-2251, S2-016)
[Affected Scope] Apache Struts framework versions 2.0.0 through 2.3.15
[Impact] Remote attackers can execute arbitrary OGNL expressions via crafted 'action:', 'redirect:', or 'redirectAction:' parameter prefixes, leading to full system compromise
[Mitigation] Immediately upgrade Apache Struts to version 2.3.15.1 or higher, or implement strict WAF rules to block vulnerable parameter prefixes
Apache Struts 2 ExceptionDelegator OGNL Injection Remote Code Execution (CVE-2012-0391, S2-008)
[Affected Scope] Apache Struts versions prior to 2.2.3.1
[Impact] Unauthenticated remote attackers can execute arbitrary Java code with system privileges on the target server by sending crafted HTTP request parameters.
[Mitigation] Immediately upgrade Apache Struts to version 2.2.3.1 or later secure releases.