CVE-2015-1831
Incomplete exclude pattern in Apache Struts
CVE-2015-1831 is a high vulnerability (CVSS 7.5) in Apache Struts, published July 16, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.32%, the 93rd percentile. Fixed in org.apache.struts:struts2-core 2.3.20.1.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 6.32%EPSS, 93rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.3.20.1org.apache.struts:struts2-core +3 more
Description
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-coreMaven | 2.0.0 up to 2.3.20.1 | 2.3.20.1 |
org.apache.struts.xwork:xwork-coreMaven | 2.0.0 up to 2.3.20.1 | 2.3.20.1 |
org.apache.struts:struts2-coreMaven | 2.0.0 up to 2.3.20.1, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 34 moreShow less2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.202.3.32.3.42.3.4.12.3.72.3.8 | 2.3.20.1 |
org.apache.struts.xwork:xwork-coreMaven | 2.0.0 up to 2.3.20.1, plus listed versions 2.2.12.2.1.12.2.32.2.3.12.3.1 Show 21 moreShow less2.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.202.3.32.3.42.3.4.12.3.72.3.8 | 2.3.20.1 |
What each source reports
NVD Score used
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.
- Record
CVE-2015-1831- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.
- Record
CVE-2015-1831- Updated
- 2026-11-02
EUVDEUVD-2022-4860No score
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.
- Record
EUVD-2022-4860- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q2cg-xf9p-h457No score
Incomplete exclude pattern in Apache Struts
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. In Struts 2.3.20.1 a better set of exlude patterns was defined.
- Record
GHSA-q2cg-xf9p-h457- Updated
- 2026-11-02
OSVGHSA-q2cg-xf9p-h457No score
Incomplete exclude pattern in Apache Struts
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. In Struts 2.3.20.1 a better set of exlude patterns was defined.
- Record
GHSA-q2cg-xf9p-h457- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.