{"id":"CVE-2015-0899","aliases":["CLSA-2025-1754006692","CLSA-2026-1788410329","DEBIAN-CVE-2015-0899","DLA-292-1","DSA-3536-1","EUVD-2022-3640","GHSA-cvvx-r33m-v7pq","MGASA-2015-0351","SUSE-SU-2015:0886-1"],"status":"published","title":"Improper Input Validation in Apache Struts","description":"The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.21261,"percentile":0.97611,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2014-06-20T20:43:07Z","modified":"2026-11-02T19:58:34Z","fixes":[{"ecosystem":"Debian:6.0","package":"libstruts1.2-java","fixed_in":["1.2.9-4+deb6u2"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"libstruts1.2-java","fixed_in":["1.2.9-5+deb7u2"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"struts","fixed_in":["1.3.10-4.2.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"struts","fixed_in":["1.3.10-8.1.mga5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.struts:struts-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1"},{"last_affected":"1.3.10"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"struts:struts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1"},{"last_affected":"1.2.9"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.struts:struts-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.5"},{"fixed":"1.3.5-tuxcare.1"}]}],"versions":["1.3.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.struts:struts-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.5"},{"fixed":"1.3.5-tuxcare.1"}]}],"versions":["1.3.5"],"bundled":5},{"source":"osv","ecosystem":"Debian:6.0","package":"libstruts1.2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-4+deb6u2"}]}],"versions":["1.2.9-4"]},{"source":"osv","ecosystem":"Debian:7","package":"libstruts1.2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-5+deb7u2"}]}],"versions":["1.2.9-5","1.2.9-5+deb7u1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.struts:struts-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1"},{"last_affected":"1.3.10"}]}],"versions":["1.3.10","1.3.5","1.3.8","1.3.9"]},{"source":"osv","ecosystem":"Maven","package":"struts:struts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1"},{"last_affected":"1.2.9"}]}],"versions":["1.1","1.2.2","1.2.4","1.2.7","1.2.8","1.2.9"]},{"source":"osv","ecosystem":"Mageia:4","package":"struts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-4.2.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"struts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-8.1.mga5"}]}]}],"products":[{"vendor":"apache","product":"struts"}],"references":[{"url":"https://security.netapp.com/advisory/ntap-20180629-0006/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2015-000042","tags":["third-party-advisory","x_refsource_JVNDB","x_transferred","Vendor Advisory","web"]},{"url":"http://jvn.jp/en/jp/JVN86448949/index.html","tags":["third-party-advisory","x_refsource_JVN","x_transferred","Vendor Advisory","web"]},{"url":"http://www.debian.org/security/2016/dsa-3536","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://en.osdn.jp/projects/terasoluna/wiki/StrutsPatch2-EN","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"http://www.securityfocus.com/bid/74423","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0899","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20180629-0006","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cvvx-r33m-v7pq"},{"url":"https://github.com/apache/struts","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2015-0351.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16601","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2015-September/165517.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150886-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/875455","tags":["report"]},{"url":"https://bugzilla.suse.com/924887","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0899","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-0899","description":"The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.","status":"published","published":"2016-07-04T22:00:00Z","modified":"2024-08-06T04:26:11.413Z","updated_at":"2026-11-02T14:35:45.428221Z"}],"euvd":[{"id":"EUVD-2022-3640","description":"The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.","status":"published","published":"2016-07-04T22:00:00Z","modified":"2024-08-06T04:26:11Z","updated_at":"2026-11-03T02:22:17.03063Z"}],"ghsa":[{"id":"GHSA-cvvx-r33m-v7pq","title":"Improper Input Validation in Apache Struts","description":"The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.","status":"published","published":"2022-05-14T03:15:11Z","modified":"2025-10-13T11:59:12Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:39:00.807341Z"}],"nvd":[{"id":"CVE-2015-0899","description":"The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.","status":"published","published":"2016-07-04T22:59:00.147Z","modified":"2026-06-17T00:21:07.107Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"GHSA-cvvx-r33m-v7pq","title":"Improper Input Validation in Apache Struts","description":"The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.","status":"published","published":"2022-05-14T03:15:11Z","modified":"2025-10-13T12:07:03.465378Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"CLSA-2025-1754006692","title":"TuxCare security update for org.apache.struts (5 CVEs)","description":"TuxCare rebuilt 2 org.apache.struts packages to address 5 CVEs. Fixed in 1.3.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-11-02T19:58:34.022004801Z","updated_at":"2026-11-02T20:23:44.164659Z"},{"id":"CLSA-2026-1788410329","title":"TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)","description":"TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.3.5-tuxcare.1.","status":"withdrawn","published":"2026-09-03T04:38:49Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"DLA-292-1","title":"libstruts1.2-java - security update","status":"published","published":"2015-08-15T00:00:00Z","modified":"2026-03-09T01:19:12.758827Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-3536-1","title":"libstruts1.2-java - security update","status":"published","published":"2016-03-31T00:00:00Z","modified":"2026-03-09T01:23:34.895775Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0351","title":"Updated struts packages fix CVE-2015-0899","description":"Updated struts packages fix security vulnerability:\n\nThe Validator in Apache Struts 1.1 and later contains a function to\nefficiently define rules for input validation across multiple pages during\nscreen transitions. This function contains a vulnerability where input\nvalidation may be bypassed. When the Apache Struts 1 Validator is used, the\nweb application may be vulnerable even when this function is not used\nexplicitly (CVE-2015-0899).\n","status":"published","published":"2015-09-08T17:55:59Z","modified":"2026-04-16T06:23:40.263157946Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"SUSE-SU-2015:0886-1","title":"Security update for struts","description":"\nApache Struts was updated to fix a security issue:\n\n    * CVE-2014-0114: The ActionForm object in Apache Struts 1.x through\n      1.3.10 allows remote attackers to 'manipulate' the ClassLoader and\n      execute arbitrary code via the class parameter, which is passed to\n      the getClass method.\n\nSecurity Issue reference:\n\n    * CVE-2014-0114\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114\u003e\n\n","status":"published","published":"2014-06-20T20:43:07Z","modified":"2026-02-04T02:25:21.455929Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}