maven org.apache.struts vulnerabilities

Latest maven org.apache.struts CVEs

Newest publication first

1. CVE-2023-50164 Apache Struts: File upload component had a directory traversal vulnerability

   Published 2023-12-07

   Critical·CVSS 9.8 EPSS 80.8% Public exploit

   An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or gre...

2. CVE-2023-41835 Apache Struts: excessive disk usage

   Published 2023-12-05

   High·CVSS 7.5 EPSS 7.3%

   When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.