CVE-2015-5169

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN95989300/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000125.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/76625Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1260087Issue Tracking, Third Party Advisory
https://security.netapp.com/advisory/ntap-20180629-0003/Third Party Advisory
https://struts.apache.org/docs/s2-025.htmlVendor Advisory
http://jvn.jp/en/jp/JVN95989300/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000125.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/76625Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1260087Issue Tracking, Third Party Advisory
https://security.netapp.com/advisory/ntap-20180629-0003/Third Party Advisory
https://struts.apache.org/docs/s2-025.htmlVendor Advisory

Timeline

Published: Sep 25, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-51708.8Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote att CVE-2015-51719.8The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic CVE-2015-51729.8Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers CVE-2015-51738.8Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers CVE-2015-51744.3Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows re CVE-2015-51757.5Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.CVE-2015-51765.8The PortletRequestDispatcher in PortletBridge, as used in Red Hat JBoss Portal 6.2.0, does not properly enforce the security constraints of CVE-2015-51777.5Double free vulnerability in the SLPDKnownDAAdd function in slpd/slpd_knownda.c in OpenSLP 1.2.1 allows remote attackers to cause a denial o CVE-2015-51784.3The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) does not send CVE-2015-51797.5FreeIPA might display user data improperly via vectors involving non-printable characters.CVE-2015-51807.5res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash CVE-2015-51815.4The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript.