CVE-2015-5209

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/82550Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1033908Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20180629-0002/
https://struts.apache.org/docs/s2-026.htmlMitigation, Vendor Advisory
http://www.securityfocus.com/bid/82550Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1033908Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20180629-0002/
https://struts.apache.org/docs/s2-026.htmlMitigation, Vendor Advisory

Timeline

Published: Aug 29, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-52105.8Open redirect vulnerability in Apache Ambari before 2.1.2 allows remote attackers to redirect users to arbitrary web sites and conduct phish CVE-2015-52119.6Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to CVE-2015-52126.8Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with CVE-2015-52136.8Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory CVE-2015-52146.8LibreOffice before 4.4.6 and 5.x before 5.0.1 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memor CVE-2015-52156.1The default configuration of the Jinja templating engine used in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not e CVE-2015-52166.1The Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly escape certain characters in a Python exception-message t CVE-2015-52174.0providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update t CVE-2015-52182.1Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a cra CVE-2015-52197.5The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which CVE-2015-52205.0The Web Console in Red Hat Enterprise Application Platform (EAP) before 6.4.4 and WildFly (formerly JBoss Application Server) allows remote CVE-2015-52215.5Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allo