CVE-2015-1831: High severity Apache struts vulnerability
Published Jul 16, 2015
·Updated
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.
Affected Software
3 affected componentsFixes available
maven/org.apache.struts.xwork:xwork-core>=2.0.0<2.3.20.1
2.3.20.1
maven/org.apache.struts:struts2-core>=2.0.0<2.3.20.1
2.3.20.1
Apache struts=2.3.20
Event History
Jul 16, 2015
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
May 17, 2022
Advisory Published
12:50 AM
Frequently Asked Questions
1
What is the severity of CVE-2015-1831?
CVE-2015-1831 has a medium severity rating due to its potential to compromise the internal state of applications depending on vulnerable versions of Apache Struts.
2
How do I fix CVE-2015-1831?
To fix CVE-2015-1831, upgrade Apache Struts to version 2.3.20.1 or later.
3
Which versions of Apache Struts are affected by CVE-2015-1831?
CVE-2015-1831 affects Apache Struts version 2.3.20 and earlier versions.
4
What kind of attacks can exploit CVE-2015-1831?
CVE-2015-1831 can be exploited by remote attackers to manipulate internal states of web applications.
5
Are there any workarounds for CVE-2015-1831?
No official workarounds are recommended for CVE-2015-1831; upgrading the affected software is advised.