{"id":"CVE-2015-1831","published":"2015-07-16T14:00:00Z","modified":"2024-08-06T04:54:16Z","title":"The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to \"compromise internal…","vendor":null,"product":null,"tier":"tail","description":{"text":"The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to \"compromise internal state of an application\" via unspecified vectors.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.06319,"percentile":0.93591,"provenance":"source"},"cwes":[],"references":[{"url":"https://struts.apache.org/docs/s2-024.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/75940","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.securitytracker.com/id/1032985","tags":["vdb-entry","x_refsource_SECTRACK"]}],"priority":{"score":18.7,"factors":[{"name":"EPSS percentile","points":18.72}]},"affected":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-core","vulnerableRanges":[">=2.0.0, <2.3.20.1"],"patched":["2.3.20.1"],"from":["GHSA-q2cg-xf9p-h457"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.struts.xwork:xwork-core","vulnerableRanges":[">=2.0.0, <2.3.20.1"],"patched":["2.3.20.1"],"from":["GHSA-q2cg-xf9p-h457"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4860","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-org-apache-struts-struts2-core-cve-2012-0393","parents":[{"from":"CVE-2014-0094","to":"CVE-2015-1831","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/src/main/resources/struts-default.xml"],"commits":["https://github.com/apache/struts/commit/2e2da292166adbc78c4cb1e308b30ddb4fba6d3f","https://github.com/apache/struts/commit/6315241719be167542962da436b38782ed730c62","https://github.com/apache/struts/commit/d832747d647df343ed07a58b1b5e540a05a4d51b"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2013-2135","published":"2013-07-16","fixed":"2.3.14.3","kev":false},{"cve":"CVE-2014-0094","published":"2014-03-10","fixed":"2.3.16.2","kev":false},{"cve":"CVE-2012-0394","published":"2012-01-08","fixed":"2.3.18","kev":false},{"cve":"CVE-2015-1831","published":"2015-07-16","fixed":"2.3.20.1","kev":false},{"cve":"CVE-2016-4430","published":"2016-07-04","fixed":"2.3.29","kev":false,"link":{"from":"CVE-2015-1831","to":"CVE-2016-4430","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts.xwork:xwork-core","fromFixed":"2.3.20.1","toFixed":"2.3.29","daysApart":354}]}},{"cve":"CVE-2016-4433","published":"2016-07-04","fixed":"2.3.29","kev":false,"link":{"from":"CVE-2015-1831","to":"CVE-2016-4433","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.struts.xwork:xwork-core","fromFixed":"2.3.20.1","toFixed":"2.3.29","daysApart":354}]}},{"cve":"CVE-2025-68493","published":"2026-01-11","fixed":"6.1.1","kev":false}],"package":"Maven:org.apache.struts.xwork:xwork-core"}}