GCVE - cpe:2.3:a:apache:struts:1.3.8:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:struts:1.3.8:*:*:*:*:*:*:*

part: a version: 1.3.8 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Struts (`81290744-d0e7-54d4-b3f9-3824c68dbf99`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/struts`	purl2cpe	2026-06-01 10:14:32.139170
`pkg:github/apache/struts`	purl2cpe	2026-06-01 10:14:32.139172
`pkg:maven/org.apache.struts/struts`	purl2cpe	2026-06-01 10:14:32.139173
`pkg:maven/org.apache.struts/struts-core`	purl2cpe	2026-06-01 10:14:32.139175
`pkg:rpm/opensuse/struts`	purl2cpe	2026-06-01 10:14:32.139176

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-1182`	vulnerable	2026-06-08 05:07:26.663184	Details available ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899. Published: 2016-07-04T22:00:00.000Z Updated: 2024-08-05T22:48:13.390Z Open on db.gcve.eu Reference links http://jvndb.jvn.jp/jvndb/JVNDB-2016-000097 http://jvn.jp/en/jp/JVN65044642/index.html http://www.securitytracker.com/id/1036056 http://www.securityfocus.com/bid/91067 http://www.securityfocus.com/bid/91787	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-1181`	vulnerable	2026-06-08 05:07:26.660950	Details available ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899. Published: 2016-07-04T22:00:00.000Z Updated: 2024-08-05T22:48:13.522Z Open on db.gcve.eu Reference links http://jvndb.jvn.jp/jvndb/JVNDB-2016-000096 http://www.securityfocus.com/bid/91068 http://www.securitytracker.com/id/1036056 http://jvn.jp/en/jp/JVN03188560/index.html http://www.securityfocus.com/bid/91787	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-0899`	vulnerable	2026-06-08 05:06:24.299786	Details available The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter. Published: 2016-07-04T22:00:00.000Z Updated: 2024-08-06T04:26:11.413Z Open on db.gcve.eu Reference links https://security.netapp.com/advisory/ntap-20180629-0006/ http://jvndb.jvn.jp/jvndb/JVNDB-2015-000042 http://jvn.jp/en/jp/JVN86448949/index.html http://www.debian.org/security/2016/dsa-3536 http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0114`	vulnerable	2026-06-08 05:05:11.559529	Details available Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1. Published: 2014-04-30T10:00:00.000Z Updated: 2024-08-06T09:05:38.989Z Open on db.gcve.eu Reference links http://apache-ignite-developers.2346864.n4.nabble.com/CVE-2014-0114-Apache-Ignite-is-vulnerable-to-existing-CVE-2014-0114-td31205.html http://secunia.com/advisories/57477 http://www.vmware.com/security/advisories/VMSA-2014-0008.html https://issues.apache.org/jira/browse/BEANUTILS-463 http://secunia.com/advisories/58710	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.