[DepShield] Vulnerability due to usage of org.apache.struts:struts2-core:2.3.1

[sonatype-depshield[bot]]

Vulnerabilities

DepShield reports that this application's usage of org.apache.struts:struts2-core:2.3.1 results in the following vulnerability(s):

• (CVSS 10.0) [CVE-2013-4316] null, Improper Access Control
• (CVSS 9.8) [CVE-2018-11776] Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remo...
• (CVSS 9.8) [CVE-2017-12611] In Apache Struts 2.0.1 through 2.3.33 and 2.5 through 2.5.10, using an unintenti...
• (CVSS 9.8) [CVE-2016-4436] Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have uns...
• (CVSS 9.8) [CVE-2016-3082] Improper Input Validation
• (CVSS 9.3) [CVE-2013-2134] Improper Control of Generation of Code ("Code Injection")
• (CVSS 9.3) [CVE-2013-2251] Improper Input Validation
• (CVSS 9.3) [CVE-2013-2115] Improper Control of Generation of Code ("Code Injection")
• (CVSS 9.3) [CVE-2013-2135] Improper Control of Generation of Code ("Code Injection")
• (CVSS 9.3) [CVE-2013-1966] Improper Control of Generation of Code ("Code Injection")
• (CVSS 8.8) [CVE-2016-3090] The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 a...
• (CVSS 8.8) [CVE-2016-4461] Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary cod...
• (CVSS 8.8) [CVE-2016-0785] Improper Input Validation
• (CVSS 8.1) [CVE-2016-3081] Improper Neutralization of Special Elements used in a Command (Command Injection)
• (CVSS 7.5) [CVE-2014-0113] Permissions, Privileges, and Access Controls
• (CVSS 7.5) [CVE-2014-0112] Permissions, Privileges, and Access Controls
• (CVSS 7.5) [CVE-2015-5209] Improper Input Validation

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[sonatype-depshield[bot]]

DepShield reports that the following additional vulnerability(s) have been discovered for org.apache.struts:struts2-core:2.3.1:

• (CVSS 6.8) [CVE-2012-4386] Cross-Site Request Forgery (CSRF)
• (CVSS 6.8) [CVE-2014-7809] Cross-Site Request Forgery (CSRF)
• (CVSS 6.4) [CVE-2012-0393] Permissions, Privileges, and Access Controls
• (CVSS 6.1) [CVE-2015-5169] Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
• (CVSS 6.1) [CVE-2016-2162] Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")
• (CVSS 6.1) CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• (CVSS 6.1) [CVE-2016-4003] Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")
• (CVSS 5.8) [CVE-2013-2248] Improper Input Validation
• (CVSS 5.8) [CVE-2014-0116] Permissions, Privileges, and Access Controls
• (CVSS 5.8) [CVE-2013-4310] Permissions, Privileges, and Access Controls
• (CVSS 5.3) [CVE-2016-3093] Improper Input Validation
• (CVSS 5.0) [CVE-2012-4387] Permissions, Privileges, and Access Controls
• (CVSS 5.0) [CVE-2014-0094] The ParametersInterceptor in Apache Struts before 2.3.16.1 allows remote attacke...