CVE-2019-0233: Improper Preservation of Permissions in Apache Struts
Summary
CVE-2019-0233: Improper Preservation of Permissions in Apache Struts. Affects org.apache.struts:struts2-core versions >= 2.0.0, < 2.5.22. Fixed in 2.5.22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is a popular open-source framework for developing Java web applications. It provides a set of reusable components and a MVC (Model-View-Controller) architecture to simplify the development process. The 'org.apache.struts:struts2-core' package is a core component of Apache Struts, responsible for handling various functionalities such as request processing, validation, and file uploads.
Vulnerability Detail
The vulnerability identified as CVE-2019-0233 in Apache Struts 2.0.0 to 2.5.20 is related to an access permission override issue. When performing a file upload, the framework fails to properly preserve permissions, leading to a potential Denial of Service (DoS) attack. An attacker could exploit this vulnerability to exhaust system resources and disrupt the normal functioning of the application.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5.22
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement additional access control measures and input validation checks to mitigate the risk of a DoS attack. This can include limiting the file size and type allowed for uploads, implementing rate limiting mechanisms, and monitoring system resources to detect any abnormal behavior.
Conclusion
The CVE-2019-0233 vulnerability in Apache Struts exposes applications to potential Denial of Service attacks. It is crucial to upgrade the 'org.apache.struts:struts2-core' package to version 2.5.22 or above to mitigate this risk. Implementing additional access control measures and input validation checks can provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and follows the MVC architecture.
The vulnerability can lead to a Denial of Service (DoS) attack, potentially causing the application to become unresponsive or crash.
To fix this vulnerability, upgrade the 'org.apache.struts:struts2-core' package to version 2.5.22 or above.
As a temporary workaround, implement additional access control measures and input validation checks to mitigate the risk.
You can find more information about this vulnerability in the CVE-2019-0233 advisory and the Apache Struts documentation.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
