{"id":"CVE-2008-6505","published":"2009-03-23T14:00:00Z","modified":"2024-08-07T11:34:46Z","title":"Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a set of directory traversal vulnerabilities in Apache Struts, affecting 2.0.x releases before 2.0.12 and 2.1.x releases before 2.1.3, located in FilterDispatcher (2.0.x) and DefaultStaticContentLoader (2.1.x). An attacker with remote network access can read arbitrary files by sending a crafted URI containing an encoded dot-dot-slash (..%252f) under a /struts/ path, with no authentication or user interaction indicated as required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:20:06Z"},"cvss":null,"epss":{"score":0.72711,"percentile":0.99444,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"http://issues.apache.org/struts/browse/WW-2779","tags":["x_refsource_CONFIRM"]},{"url":"http://struts.apache.org/2.x/docs/s2-004.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.vupen.com/english/advisories/2008/3003","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://secunia.com/advisories/32497","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securityfocus.com/bid/32104","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://osvdb.org/49733","tags":["vdb-entry","x_refsource_OSVDB"]},{"url":"http://osvdb.org/49734","tags":["vdb-entry","x_refsource_OSVDB"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.0.0, <2.0.12",">=2.1.0, <2.1.3"],"patched":["2.0.12","2.1.3"],"from":["GHSA-wv7g-xhvw-8hcp"],"provenance":"source"}],"advisories":[{"id":"GHSA-wv7g-xhvw-8hcp","url":"https://github.com/advisories/GHSA-wv7g-xhvw-8hcp","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.0.0, <2.0.12"],"patched":["2.0.12"],"provenance":"source","from":"GHSA"},{"id":"GHSA-wv7g-xhvw-8hcp","url":"https://github.com/advisories/GHSA-wv7g-xhvw-8hcp","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.1.0, <2.1.3"],"patched":["2.1.3"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-5640","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5640","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":32565,"url":"https://www.exploit-db.com/exploits/32565","title":"Struts 2.0.11 - Multiple Directory Traversal Vulnerabilities","type":"remote","platform":"multiple","date":"2008-11-04","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2008-11-04"},"first":{"date":"2008-11-04","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/32565"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2008-11-04","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-32565)","url":"https://www.exploit-db.com/exploits/32565","provenance":"source"},{"date":"2009-03-23","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2008-6505","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":24.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.89,"detail":"percentile 0.9944"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2008-6682","published":"2009-04-09","fixed":"2.1.1","kev":false},{"cve":"CVE-2008-6505","published":"2009-03-23","fixed":"2.1.3","kev":false},{"cve":"CVE-2010-1870","published":"2010-08-17","fixed":"2.2.1","kev":false,"link":{"from":"CVE-2008-6505","to":"CVE-2010-1870","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts:struts2-core","fromFixed":"2.1.3","toFixed":"2.2.1","daysApart":512}]}},{"cve":"CVE-2011-1772","published":"2011-05-13","fixed":"2.2.3","kev":false},{"cve":"CVE-2012-0391","published":"2012-01-08","fixed":"2.2.3.1","kev":true}],"package":"Maven:org.apache.struts:struts2-core"}}