CVE-2015-2992
Cross-site Scripting in Apache Struts
CVE-2015-2992 is a medium vulnerability (CVSS 6.1) in Apache Struts, published February 27, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.76%, the 93rd percentile. Fixed in org.apache.struts:struts2-core 2.3.20.
Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
- Record
CVE-2015-2992- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
- Record
CVE-2015-2992- Updated
- 2026-11-02
EUVDEUVD-2022-1915 No score
Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
- Record
EUVD-2022-1915- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-265r-pp83-gww7 No score
Cross-site Scripting in Apache Struts
When the Struts2 debug mode is turned on, under certain conditions an arbitrary script may be executed in the 'Problem Report' screen. Also if JSP files are exposed to be accessed directly it's possible to execute an arbitrary script.
It is generally not advisable to have debug mode switched on outside of the development environment. Debug mode should always be turned off in production setup. Also never expose JSPs files directly and hide them inside WEB-INF folder or define dedicated security constraints to block access to raw JSP files.
Struts >= 2.3.20 is not vulnerable to this attack. We recommend upgrading to Struts 2.3.20 or higher if turning off debug mode is not possible.
- Record
GHSA-265r-pp83-gww7- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-265r-pp83-gww7 No score
Cross-site Scripting in Apache Struts
When the Struts2 debug mode is turned on, under certain conditions an arbitrary script may be executed in the 'Problem Report' screen. Also if JSP files are exposed to be accessed directly it's possible to execute an arbitrary script.
It is generally not advisable to have debug mode switched on outside of the development environment. Debug mode should always be turned off in production setup. Also never expose JSPs files directly and hide them inside WEB-INF folder or define dedicated security constraints to block access to raw JSP files.
Struts >= 2.3.20 is not vulnerable to this attack. We recommend upgrading to Struts 2.3.20 or higher if turning off debug mode is not possible.
- Record
GHSA-265r-pp83-gww7- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-coreMaven |
before 2.3.20 | 2.3.20 |
org.apache.struts:struts2-coreMaven |
before 2.3.20, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 33 moreShow less2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.32.3.42.3.4.12.3.72.3.8 |
2.3.20 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
jvn.jp/en/jp/JVN88408929/index.html
jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000124.html
securityfocus.com/bid/76624
security.netapp.com/advisory/ntap-20200330-0001
nvd.nist.gov/vuln/detail/CVE-2015-2992
cwiki.apache.org/confluence/display/WW/S2-025
github.com/advisories/GHSA-265r-pp83-gww7