CVE-2015-5169: Cross-site Scripting in Apache Struts
Summary
CVE-2015-5169: Cross-site Scripting in Apache Struts. Affects org.apache.struts:struts2-core versions < 2.3.20. Fixed in 2.3.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC (Model-View-Controller) architecture for building scalable and maintainable web applications. The vulnerability identified as CVE-2015-5169 affects the Struts2 core package. This vulnerability allows an attacker to execute arbitrary scripts under certain conditions, either through the 'Problem Report' screen or by accessing JSP files directly. It is important to note that this vulnerability can only be exploited when the Struts2 debug mode is turned on or when JSP files are exposed to direct access.
Vulnerability Detail
The CVE-2015-5169 vulnerability in Apache Struts allows for cross-site scripting (XSS) attacks. When the debug mode is enabled, an attacker can inject and execute arbitrary scripts in the 'Problem Report' screen. Additionally, if JSP files are directly accessible, an attacker can also execute arbitrary scripts. This vulnerability can lead to unauthorized access, data theft, and other malicious activities. It is crucial to disable the debug mode in production environments and ensure that JSP files are not exposed to direct access.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.20
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, it is advised to hide JSP files inside the WEB-INF folder or define dedicated security constraints to block access to raw JSP files. By restricting direct access to JSP files, the potential for executing arbitrary scripts is minimized. It is also important to ensure that the debug mode is turned off in the production environment.
Conclusion
The CVE-2015-5169 vulnerability in Apache Struts exposes applications to cross-site scripting attacks. To mitigate this vulnerability, it is crucial to upgrade to Struts 2.3.20 or higher, disable the debug mode in the production setup, and ensure that JSP files are not directly accessible. Regularly monitoring for vulnerabilities and applying security patches is essential to maintain the security of web applications. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC architecture for building scalable and maintainable web applications.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized access, data theft, and other malicious activities.
The CVE-2015-5169 vulnerability in Apache Struts allows attackers to execute arbitrary scripts under certain conditions. This can lead to unauthorized access, data theft, and other malicious activities.
To fix the CVE-2015-5169 vulnerability, it is recommended to upgrade to Struts 2.3.20 or higher. Additionally, the debug mode should be disabled in the production setup.
The CVE-2015-5169 vulnerability in Apache Struts can lead to unauthorized access, data theft, and other malicious activities. It is important to apply the necessary security patches and take preventive measures to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
