CVE-2015-0899
High · 7.5CVSS
7.5
EPSS
21.3%
Published
Jul 4, 2016
CISA due date
—
The record
The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.struts:struts-core | 1.1 | No fix |
| Maven | struts:struts | 1.1 | No fix |
| Debian:6.0 | libstruts1.2-java | 0 | 1.2.9-4+deb6u2 |
| Debian:7 | libstruts1.2-java | 0 | 1.2.9-5+deb7u2 |
| Mageia:4 | struts | 0 | 1.3.10-4.2.mga4 |
| Mageia:5 | struts | 0 | 1.3.10-8.1.mga5 |
| maven | org.apache.struts/struts-core | 1.1 | No fix |
| maven | struts/struts | 1.1 | No fix |
Related vulnerabilities
- CVE-2016-1182 ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the… Also affects org.apache.struts:struts-core
- CVE-2016-1181 ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access… Also affects org.apache.struts:struts-core
- CVE-2012-1007 Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote… Also affects org.apache.struts:struts-core
- CVE-2005-3745 Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other… Also affects org.apache.struts:struts-core
- CVE-2006-1547 ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7… Also affects struts:struts
- CVE-2014-0114 Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache… Also affects libstruts1.2-java
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-20
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-20