Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

apache struts 2.3.24.3 vulnerabilities and exploits

(subscribe to this query)

5
CVSSv2
CVE-2016-4433
Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request....
Apache Struts 2.3.20Apache Struts 2.3.20.1Apache Struts 2.3.20.3Apache Struts 2.3.24Apache Struts 2.3.24.1Apache Struts 2.3.24.3Apache Struts 2.3.28
5
CVSSv2
CVE-2016-4431
Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method....
Apache Struts 2.3.20Apache Struts 2.3.20.1Apache Struts 2.3.20.3Apache Struts 2.3.24Apache Struts 2.3.24.1Apache Struts 2.3.24.3Apache Struts 2.3.28
6.8
CVSSv2
CVE-2016-4430
Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors....
Apache Struts 2.3.20Apache Struts 2.3.20.1Apache Struts 2.3.20.3Apache Struts 2.3.24Apache Struts 2.3.24.1Apache Struts 2.3.24.3Apache Struts 2.3.28Apache Struts 2.3.28.1
7.5
CVSSv2
CVE-2016-4438
The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression....
Apache Struts 2.3.20Apache Struts 2.3.20.1Apache Struts 2.3.20.3Apache Struts 2.3.24Apache Struts 2.3.24.1Apache Struts 2.3.24.3Apache Struts 2.3.28
7.5
CVSSv2
CVE-2016-6795
In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side....
Apache Struts 2.3.20Apache Struts 2.3.20.1Apache Struts 2.3.20.2Apache Struts 2.3.20.3Apache Struts 2.3.21Apache Struts 2.3.22Apache Struts 2.3.23Apache Struts 2.3.24Apache Struts 2.3.24.1Apache Struts 2.3.24.2Apache Struts 2.3.24.3Apache Struts 2.3.25Apache Struts 2.3.26Apache Struts 2.3.27Apache Struts 2.3.28Apache Struts 2.3.28.1Apache Struts 2.3.29Apache Struts 2.3.30
5
CVSSv2
CVE-2016-4465
The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field....
Apache Struts 2.3.20Apache Struts 2.3.20.1Apache Struts 2.3.20.3Apache Struts 2.3.24Apache Struts 2.3.24.1Apache Struts 2.3.24.3Apache Struts 2.3.28Apache Struts 2.3.28.1Apache Struts 2.5
7.5
CVSSv2
CVE-2017-9791
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage....
Apache Struts 2.3.1Apache Struts 2.3.1.1Apache Struts 2.3.1.2Apache Struts 2.3.3Apache Struts 2.3.4Apache Struts 2.3.4.1Apache Struts 2.3.7Apache Struts 2.3.8Apache Struts 2.3.12Apache Struts 2.3.14Apache Struts 2.3.14.1Apache Struts 2.3.14.2Apache Struts 2.3.14.3Apache Struts 2.3.15Apache Struts 2.3.15.1Apache Struts 2.3.15.2Apache Struts 2.3.15.3Apache Struts 2.3.16Apache Struts 2.3.16.1Apache Struts 2.3.16.2Apache Struts 2.3.16.3Apache Struts 2.3.20Apache Struts 2.3.20.1Apache Struts 2.3.20.3Apache Struts 2.3.24Apache Struts 2.3.24.1Apache Struts 2.3.24.3Apache Struts 2.3.28Apache Struts 2.3.28.1Apache Struts 2.3.29Apache Struts 2.3.30Apache Struts 2.3.31Apache Struts 2.3.32
10
CVSSv2
CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type,...
Apache Struts 2.3.5Apache Struts 2.3.6Apache Struts 2.3.7Apache Struts 2.3.8Apache Struts 2.3.9Apache Struts 2.3.10Apache Struts 2.3.11Apache Struts 2.3.12Apache Struts 2.3.13Apache Struts 2.3.14Apache Struts 2.3.14.1Apache Struts 2.3.14.2Apache Struts 2.3.14.3Apache Struts 2.3.15Apache Struts 2.3.15.1Apache Struts 2.3.15.2Apache Struts 2.3.15.3Apache Struts 2.3.16Apache Struts 2.3.16.1Apache Struts 2.3.16.2Apache Struts 2.3.16.3Apache Struts 2.3.17Apache Struts 2.3.19Apache Struts 2.3.20Apache Struts 2.3.20.1Apache Struts 2.3.20.2Apache Struts 2.3.20.3Apache Struts 2.3.21Apache Struts 2.3.22Apache Struts 2.3.23Apache Struts 2.3.24Apache Struts 2.3.24.1Apache Struts 2.3.24.2Apache Struts 2.3.24.3Apache Struts 2.3.25Apache Struts 2.3.26Apache Struts 2.3.27Apache Struts 2.3.28Apache Struts 2.3.28.1Apache Struts 2.3.29Apache Struts 2.3.30Apache Struts 2.3.31Apache Struts 2.5Apache Struts 2.5.1Apache Struts 2.5.2Apache Struts 2.5.3Apache Struts 2.5.4Apache Struts 2.5.5Apache Struts 2.5.6Apache Struts 2.5.7Apache Struts 2.5.8Apache Struts 2.5.9Apache Struts 2.5.10
7.5
CVSSv2
CVE-2016-4436
Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up....
Apache Struts 2.0.0Apache Struts 2.0.1Apache Struts 2.0.2Apache Struts 2.0.3Apache Struts 2.0.4Apache Struts 2.0.5Apache Struts 2.0.6Apache Struts 2.0.7Apache Struts 2.0.8Apache Struts 2.0.9Apache Struts 2.0.11Apache Struts 2.0.11.1Apache Struts 2.0.11.2Apache Struts 2.0.12Apache Struts 2.0.14Apache Struts 2.1.6Apache Struts 2.1.8Apache Struts 2.1.8.1Apache Struts 2.2.1Apache Struts 2.2.1.1Apache Struts 2.2.3Apache Struts 2.2.3.1Apache Struts 2.3.1Apache Struts 2.3.1.1Apache Struts 2.3.1.2Apache Struts 2.3.3Apache Struts 2.3.4Apache Struts 2.3.4.1Apache Struts 2.3.7Apache Struts 2.3.8Apache Struts 2.3.12Apache Struts 2.3.14Apache Struts 2.3.14.1Apache Struts 2.3.14.2Apache Struts 2.3.14.3Apache Struts 2.3.15Apache Struts 2.3.15.1Apache Struts 2.3.15.2Apache Struts 2.3.15.3Apache Struts 2.3.16Apache Struts 2.3.16.1Apache Struts 2.3.16.2Apache Struts 2.3.16.3Apache Struts 2.3.20Apache Struts 2.3.20.1Apache Struts 2.3.20.3Apache Struts 2.3.24Apache Struts 2.3.24.1Apache Struts 2.3.24.3Apache Struts 2.3.28Apache Struts 2.3.28.1Apache Struts 2.5
5
CVSSv2
CVE-2017-9793
The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload....
Apache Struts 2.3.7Apache Struts 2.3.8Apache Struts 2.3.9Apache Struts 2.3.10Apache Struts 2.3.11Apache Struts 2.3.12Apache Struts 2.3.13Apache Struts 2.3.14Apache Struts 2.3.14.1Apache Struts 2.3.14.2Apache Struts 2.3.14.3Apache Struts 2.3.15Apache Struts 2.3.15.1Apache Struts 2.3.15.2Apache Struts 2.3.15.3Apache Struts 2.3.16Apache Struts 2.3.16.1Apache Struts 2.3.16.2Apache Struts 2.3.16.3Apache Struts 2.3.17Apache Struts 2.3.19Apache Struts 2.3.20Apache Struts 2.3.20.1Apache Struts 2.3.20.2Apache Struts 2.3.21Apache Struts 2.3.22Apache Struts 2.3.23Apache Struts 2.3.24.2Apache Struts 2.3.24.3Apache Struts 2.3.25Apache Struts 2.3.26Apache Struts 2.3.27Apache Struts 2.3.28Apache Struts 2.3.28.1Apache Struts 2.3.29Apache Struts 2.3.30Apache Struts 2.3.31Apache Struts 2.3.32Apache Struts 2.3.33Apache Struts 2.5Apache Struts 2.5.1Apache Struts 2.5.2Apache Struts 2.5.3Apache Struts 2.5.4Apache Struts 2.5.5Apache Struts 2.5.6Apache Struts 2.5.7Apache Struts 2.5.8Apache Struts 2.5.9Apache Struts 2.5.10Apache Struts 2.5.10.1Apache Struts 2.5.12
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
unprivilegedCVE-2016-8138CVE-2016-8155local file inclusionCVE-2016-8111CVE-2021-27730XML external entityCVE-2021-21973CVE-2021-21972