CVE-2015-1831
Incomplete exclude pattern in Apache Struts
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.
- Record
CVE-2015-1831- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.
- Record
CVE-2015-1831- Updated
- 2026-11-02
EUVDEUVD-2022-4860 No score
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.
- Record
EUVD-2022-4860- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q2cg-xf9p-h457 No score
Incomplete exclude pattern in Apache Struts
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. In Struts 2.3.20.1 a better set of exlude patterns was defined.
- Record
GHSA-q2cg-xf9p-h457- Updated
- 2026-11-02
OSVGHSA-q2cg-xf9p-h457 No score
Incomplete exclude pattern in Apache Struts
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. In Struts 2.3.20.1 a better set of exlude patterns was defined.
- Record
GHSA-q2cg-xf9p-h457- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-coreMaven |
2.0.0 up to 2.3.20.1 | 2.3.20.1 |
org.apache.struts.xwork:xwork-coreMaven |
2.0.0 up to 2.3.20.1 | 2.3.20.1 |
org.apache.struts:struts2-coreMaven |
2.0.0 up to 2.3.20.1, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 34 moreShow less2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.202.3.32.3.42.3.4.12.3.72.3.8 |
2.3.20.1 |
org.apache.struts.xwork:xwork-coreMaven |
2.0.0 up to 2.3.20.1, plus listed versions 2.2.12.2.1.12.2.32.2.3.12.3.1 Show 21 moreShow less2.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.202.3.32.3.42.3.4.12.3.72.3.8 |
2.3.20.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-1831 is a high vulnerability (CVSS 7.5) in Apache Struts, published July 16, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.32%, the 93rd percentile. Fixed in org.apache.struts:struts2-core 2.3.20.1.