CVE-2015-0899

Improper Input Validation in Apache Struts

7.5 HighFix available

CVE-2015-0899 is a high vulnerability (CVSS 7.5) in Apache Struts, published June 20, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 21.3%, the 97th percentile. Fixed in org.apache.struts:struts-core 1.3.5-tuxcare.1.

The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

21.3%Up 15.4 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.

Record: CVE-2015-0899
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.

Record: CVE-2015-0899
Updated: 2026-11-02

EUVDEUVD-2022-3640 No score

The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.

Record: EUVD-2022-3640
Updated: 2026-11-03

GitHub AdvisoriesGHSA-cvvx-r33m-v7pq 7.5

Improper Input Validation in Apache Struts

The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.

Record: GHSA-cvvx-r33m-v7pq
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-20
Updated: 2026-11-02

OSVGHSA-cvvx-r33m-v7pq 7.5

Improper Input Validation in Apache Struts

The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.

Record: GHSA-cvvx-r33m-v7pq
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-20
Updated: 2026-11-02

OSVCLSA-2025-1754006692 No score

TuxCare security update for org.apache.struts (5 CVEs)

TuxCare rebuilt 2 org.apache.struts packages to address 5 CVEs. Fixed in 1.3.5-tuxcare.1.

Record: CLSA-2025-1754006692
Updated: 2026-11-02

OSVCLSA-2026-1788410329 No score

TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)

TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.3.5-tuxcare.1.

Record: CLSA-2026-1788410329
Updated: 2026-11-02

OSVMGASA-2015-0351 No score

Updated struts packages fix CVE-2015-0899

Updated struts packages fix security vulnerability:

The Validator in Apache Struts 1.1 and later contains a function to efficiently define rules for input validation across multiple pages during screen transitions. This function contains a vulnerability where input validation may be bypassed. When the Apache Struts 1 Validator is used, the web application may be vulnerable even when this function is not used explicitly (CVE-2015-0899).

Record: MGASA-2015-0351
Updated: 2026-11-02

OSVSUSE-SU-2015:0886-1 No score

Security update for struts

Apache Struts was updated to fix a security issue:

* CVE-2014-0114: The ActionForm object in Apache Struts 1.x through
  1.3.10 allows remote attackers to 'manipulate' the ClassLoader and
  execute arbitrary code via the class parameter, which is passed to
  the getClass method.

Security Issue reference:

* CVE-2014-0114
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114>

Record: SUSE-SU-2015:0886-1
Updated: 2026-11-02

Affected products

apache struts

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.struts:struts-core` Maven	1.1 to 1.3.10	None known
`struts:struts` Maven	1.1 to 1.2.9	None known
`org.apache.struts:struts-core` TuxCare:Maven	1.3.5 up to 1.3.5-tuxcare.1	1.3.5-tuxcare.1
`org.apache.struts:struts-extras` TuxCare:Maven	1.3.5 up to 1.3.5-tuxcare.1	1.3.5-tuxcare.1
`libstruts1.2-java` Debian:6.0	before 1.2.9-4+deb6u2, plus listed versions 1.2.9-4	1.2.9-4+deb6u2
`libstruts1.2-java` Debian:7	before 1.2.9-5+deb7u2, plus listed versions 1.2.9-51.2.9-5+deb7u1	1.2.9-5+deb7u2
`org.apache.struts:struts-core` Maven	1.1 to 1.3.10, plus listed versions 1.3.51.3.81.3.9	None known
`struts:struts` Maven	1.1 to 1.2.9, plus listed versions 1.2.21.2.41.2.71.2.8	None known
`struts` Mageia:4	before 1.3.10-4.2.mga4	1.3.10-4.2.mga4
`struts` Mageia:5	before 1.3.10-8.1.mga5	1.3.10-8.1.mga5

History

History
When	Changed	Sources
2026-11-03	affected
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 12 moreShow less