{"id":"CVE-2015-5209","aliases":["EUVD-2022-2429","GHSA-4qgj-9mvg-3929"],"status":"published","title":"Special top object can be used to access Struts' internals","description":"Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.09063,"percentile":0.95319,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2017-08-29T15:00:00Z","modified":"2026-06-17T00:28:40Z","fixes":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-core","fixed_in":["2.3.24.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.struts:struts2-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.24.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.struts:struts2-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.24.1"}]}],"versions":["2.0.11","2.0.11.1","2.0.11.2","2.0.12","2.0.14","2.0.5","2.0.6","2.0.8","2.0.9","2.1.2","2.1.6","2.1.8","2.1.8.1","2.2.1","2.2.1.1","2.2.3","2.2.3.1","2.3.1","2.3.1.1","2.3.1.2","2.3.12","2.3.14","2.3.14.1","2.3.14.2","2.3.14.3","2.3.15","2.3.15.1","2.3.15.2","2.3.15.3","2.3.16","2.3.16.1","2.3.16.2","2.3.16.3","2.3.20","2.3.20.1","2.3.20.3","2.3.24","2.3.3","2.3.4","2.3.4.1","2.3.7","2.3.8"]}],"products":[{"vendor":"apache","product":"struts"}],"references":[{"url":"http://www.securitytracker.com/id/1033908","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/82550","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://security.netapp.com/advisory/ntap-20180629-0002/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://struts.apache.org/docs/s2-026.html","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5209","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4qgj-9mvg-3929"},{"url":"https://security.netapp.com/advisory/ntap-20180629-0002","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-5209","description":"Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object.","status":"published","published":"2017-08-29T15:00:00Z","modified":"2024-08-06T06:41:08.035Z","updated_at":"2026-11-02T14:35:39.846011Z"}],"euvd":[{"id":"EUVD-2022-2429","description":"Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object.","status":"published","published":"2017-08-29T15:00:00Z","modified":"2024-08-06T06:41:08Z","updated_at":"2026-11-03T02:22:00.863884Z"}],"ghsa":[{"id":"GHSA-4qgj-9mvg-3929","title":"Special top object can be used to access Struts' internals","description":"ValueStack defines special top object which represents root of execution context. It can be used to manipulate Struts' internals or can be used to affect container's settings. Applying better regex which includes pattern to exclude request parameters trying to use top object. This issue was patched in Struts 2.3.24.1.","status":"published","published":"2022-05-14T03:15:08Z","modified":"2023-02-01T05:04:27Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:32.120868Z"}],"nvd":[{"id":"CVE-2015-5209","description":"Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object.","status":"published","published":"2017-08-29T15:29:00.393Z","modified":"2026-06-17T00:28:40.667Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:17.730372Z"}],"osv":[{"id":"GHSA-4qgj-9mvg-3929","title":"Special top object can be used to access Struts' internals","description":"ValueStack defines special top object which represents root of execution context. It can be used to manipulate Struts' internals or can be used to affect container's settings. Applying better regex which includes pattern to exclude request parameters trying to use top object. This issue was patched in Struts 2.3.24.1.","status":"published","published":"2022-05-14T03:15:08Z","modified":"2024-02-18T05:31:29.501743Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:37.148947Z"}]}}