CVE-2015-5169
Cross-site Scripting in Apache Struts
Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
- Record
CVE-2015-5169- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
- Record
CVE-2015-5169- Updated
- 2026-11-02
EUVDEUVD-2022-5443 No score
Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
- Record
EUVD-2022-5443- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vwhv-j36g-5rm8
Cross-site Scripting in Apache Struts
When the Struts2 debug mode is turned on, under certain conditions an arbitrary script may be executed in the 'Problem Report' screen. Also if JSP files are exposed to be accessed directly it's possible to execute an arbitrary script.
It is generally not advisable to have debug mode switched on outside of the development environment. Debug mode should always be turned off in production setup. Also never expose JSPs files directly and hide them inside WEB-INF folder or define dedicated security constraints to block access to raw JSP files.
Struts >= 2.3.20 is not vulnerable to this attack. We recommend upgrading to Struts 2.3.20 or higher.
- Record
GHSA-vwhv-j36g-5rm8- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-vwhv-j36g-5rm8
Cross-site Scripting in Apache Struts
When the Struts2 debug mode is turned on, under certain conditions an arbitrary script may be executed in the 'Problem Report' screen. Also if JSP files are exposed to be accessed directly it's possible to execute an arbitrary script.
It is generally not advisable to have debug mode switched on outside of the development environment. Debug mode should always be turned off in production setup. Also never expose JSPs files directly and hide them inside WEB-INF folder or define dedicated security constraints to block access to raw JSP files.
Struts >= 2.3.20 is not vulnerable to this attack. We recommend upgrading to Struts 2.3.20 or higher.
- Record
GHSA-vwhv-j36g-5rm8- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-coreMaven |
before 2.3.20 | 2.3.20 |
org.apache.struts:struts2-coreMaven |
before 2.3.20, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 33 moreShow less2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.32.3.42.3.4.12.3.72.3.8 |
2.3.20 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-5169 is a medium vulnerability (CVSS 6.1) in Apache Struts, published September 25, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.53%, the 94th percentile. Fixed in org.apache.struts:struts2-core 2.3.20.
References
security.netapp.com/advisory/ntap-20180629-0003
securityfocus.com/bid/76625
struts.apache.org/docs/s2-025.html
jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000125.html
bugzilla.redhat.com/show_bug.cgi?id=1260087
jvn.jp/en/jp/JVN95989300/index.html
nvd.nist.gov/vuln/detail/CVE-2015-5169
github.com/advisories/GHSA-vwhv-j36g-5rm8