Apache Struts

The US cybersecurity agency CISA lists these vulnerabilities in its catalog of Known Exploited Vulnerabilities. Check your version and patch or mitigate promptly.

• CVE-2017-5638Apache Struts Remote Code Execution VulnerabilityRansomware

  9.8 critical · over the network, without login · CISA deadline was 3 May 22

• CVE-2020-17530Apache Struts Remote Code Execution Vulnerability

  9.8 critical · over the network, without login · CISA deadline was 3 May 22

• CVE-2012-0391Apache Struts 2 Improper Input Validation Vulnerability

  9.8 critical · over the network, without login · CISA deadline was 21 Jul 22

• CVE-2017-9791Apache Struts 1 Improper Input Validation Vulnerability

  9.8 critical · over the network, without login · CISA deadline was 10 Aug 22

• CVE-2013-2251Apache Struts Improper Input Validation Vulnerability

  9.8 critical · over the network, without login · CISA deadline was 15 Apr 22

• CVE-2018-11776Apache Struts Remote Code Execution Vulnerability

  8.1 high · over the network, without login · CISA deadline was 3 May 22

• CVE-2017-9805Apache Struts Deserialization of Untrusted Data Vulnerability

  8.1 high · over the network, without login · CISA deadline was 3 May 22

• CVE-2006-1547Apache Struts 1 ActionForm Denial-of-Service Vulnerability

  7.5 high · over the network, without login · CISA deadline was 21 Jul 22

Source: CISA KEV. The CVE is matched to the product automatically — when in doubt, the linked NVD entry applies.