Skip to content

CVE-2015-5209 Special top object can be used to access Struts' internals

HighCVSS 7.5 EPSS 9.1%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object.

Affected products

ProductAffected versionsFixed in
org.apache.struts/struts2-core(Maven) < 2.3.24.1 2.3.24.1
org.apache.struts/struts2-core(Maven) = 2.0.11 No fix listed
org.apache.struts/struts2-core(Maven) = 2.0.11.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.0.11.2 No fix listed
org.apache.struts/struts2-core(Maven) = 2.0.12 No fix listed
org.apache.struts/struts2-core(Maven) = 2.0.14 No fix listed
org.apache.struts/struts2-core(Maven) = 2.0.5 No fix listed
org.apache.struts/struts2-core(Maven) = 2.0.6 No fix listed
org.apache.struts/struts2-core(Maven) = 2.0.8 No fix listed
org.apache.struts/struts2-core(Maven) = 2.0.9 No fix listed
org.apache.struts/struts2-core(Maven) = 2.1.2 No fix listed
org.apache.struts/struts2-core(Maven) = 2.1.6 No fix listed
org.apache.struts/struts2-core(Maven) = 2.1.8 No fix listed
org.apache.struts/struts2-core(Maven) = 2.1.8.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.2.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.2.1.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.2.3 No fix listed
org.apache.struts/struts2-core(Maven) = 2.2.3.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.1.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.1.2 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.12 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.14 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.14.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.14.2 No fix listed
Show 84 more
ProductAffected versionsFixed in
org.apache.struts/struts2-core(Maven) = 2.3.14.3 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.15 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.15.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.15.2 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.15.3 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.16 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.16.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.16.2 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.16.3 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.20 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.20.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.20.3 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.24 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.3 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.4 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.4.1 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.7 No fix listed
org.apache.struts/struts2-core(Maven) = 2.3.8 No fix listed
apache struts = 2.0.0 No fix listed
apache struts = 2.0.1 No fix listed
apache struts = 2.0.2 No fix listed
apache struts = 2.0.3 No fix listed
apache struts = 2.0.4 No fix listed
apache struts = 2.0.5 No fix listed
apache struts = 2.0.6 No fix listed
apache struts = 2.0.7 No fix listed
apache struts = 2.0.8 No fix listed
apache struts = 2.0.9 No fix listed
apache struts = 2.0.10 No fix listed
apache struts = 2.0.11 No fix listed
apache struts = 2.0.11.1 No fix listed
apache struts = 2.0.11.2 No fix listed
apache struts = 2.0.12 No fix listed
apache struts = 2.0.13 No fix listed
apache struts = 2.0.14 No fix listed
apache struts = 2.1.0 No fix listed
apache struts = 2.1.1 No fix listed
apache struts = 2.1.2 No fix listed
apache struts = 2.1.3 No fix listed
apache struts = 2.1.4 No fix listed
apache struts = 2.1.5 No fix listed
apache struts = 2.1.6 No fix listed
apache struts = 2.1.8 No fix listed
apache struts = 2.1.8.1 No fix listed
apache struts = 2.2.1 No fix listed
apache struts = 2.2.1.1 No fix listed
apache struts = 2.2.3 No fix listed
apache struts = 2.2.3.1 No fix listed
apache struts = 2.3.1 No fix listed
apache struts = 2.3.1.1 No fix listed
apache struts = 2.3.1.2 No fix listed
apache struts = 2.3.3 No fix listed
apache struts = 2.3.4 No fix listed
apache struts = 2.3.4.1 No fix listed
apache struts = 2.3.5 No fix listed
apache struts = 2.3.6 No fix listed
apache struts = 2.3.7 No fix listed
apache struts = 2.3.8 No fix listed
apache struts = 2.3.9 No fix listed
apache struts = 2.3.10 No fix listed
apache struts = 2.3.11 No fix listed
apache struts = 2.3.12 No fix listed
apache struts = 2.3.13 No fix listed
apache struts = 2.3.14 No fix listed
apache struts = 2.3.14.1 No fix listed
apache struts = 2.3.14.2 No fix listed
apache struts = 2.3.14.3 No fix listed
apache struts = 2.3.15 No fix listed
apache struts = 2.3.15.1 No fix listed
apache struts = 2.3.15.2 No fix listed
apache struts = 2.3.15.3 No fix listed
apache struts = 2.3.16 No fix listed
apache struts = 2.3.16.1 No fix listed
apache struts = 2.3.16.2 No fix listed
apache struts = 2.3.16.3 No fix listed
apache struts = 2.3.17 No fix listed
apache struts = 2.3.19 No fix listed
apache struts = 2.3.20 No fix listed
apache struts = 2.3.20.1 No fix listed
apache struts = 2.3.20.2 No fix listed
apache struts = 2.3.21 No fix listed
apache struts = 2.3.22 No fix listed
apache struts = 2.3.23 No fix listed
apache struts = 2.3.24 No fix listed

References