CVE-2015-2992: Cross-site Scripting in Apache Struts
Summary
CVE-2015-2992: Cross-site Scripting in Apache Struts. Affects org.apache.struts:struts2-core versions < 2.3.20. Fixed in 2.3.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC (Model-View-Controller) architecture for building scalable and maintainable web applications. The vulnerability in question affects versions of Struts prior to 2.3.20. When the debug mode is enabled, an attacker can exploit certain conditions to execute arbitrary scripts on the 'Problem Report' screen or by directly accessing exposed JSP files. This can lead to cross-site scripting (XSS) attacks, where malicious scripts are injected into web pages viewed by users, potentially compromising their sensitive information or performing unauthorized actions.
Vulnerability Detail
The vulnerability arises from the improper handling of debug mode and direct access to JSP files. When debug mode is enabled, an attacker can inject arbitrary scripts into the 'Problem Report' screen, potentially leading to XSS attacks. Similarly, if JSP files are exposed and accessible directly, an attacker can execute arbitrary scripts. This vulnerability can be mitigated by disabling debug mode in production environments and properly securing JSP files by hiding them inside the WEB-INF folder or applying security constraints to block direct access. Struts versions 2.3.20 and higher are not vulnerable to this attack.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.20
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A possible workaround for this vulnerability is to disable debug mode in the Struts configuration. This can be done by setting the 'struts.devMode' property to 'false' in the struts.xml file. Additionally, JSP files should be secured by moving them to the WEB-INF folder or applying security constraints in the web.xml file to restrict direct access.
Conclusion
The CVE-2015-2992 vulnerability in Apache Struts allows for cross-site scripting attacks when debug mode is enabled or JSP files are exposed. To mitigate this vulnerability, it is recommended to upgrade to Struts version 2.3.20 or higher, disable debug mode in production setups, and properly secure JSP files. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC architecture for building scalable and maintainable web applications.
Cross-site scripting (XSS) is a type of security vulnerability where an attacker can inject malicious scripts into web pages viewed by users. This can lead to the compromise of sensitive information or unauthorized actions.
This vulnerability affects versions of Apache Struts prior to 2.3.20. When debug mode is enabled or JSP files are exposed, an attacker can execute arbitrary scripts, potentially leading to XSS attacks.
To fix this vulnerability, it is recommended to upgrade to Struts version 2.3.20 or higher. Additionally, debug mode should be turned off in production setups and proper security measures should be implemented to protect JSP files.
Yes, a possible workaround is to disable debug mode in the Struts configuration and secure JSP files by moving them to the WEB-INF folder or applying security constraints.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
