High severityNVD Advisory· Published Jul 16, 2015· Updated Jun 17, 2026
CVE-2015-1831
CVE-2015-1831
Description
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.struts:struts2-coreMaven | >= 2.0.0, < 2.3.20.1 | 2.3.20.1 |
org.apache.struts.xwork:xwork-coreMaven | >= 2.0.0, < 2.3.20.1 | 2.3.20.1 |
Affected products
3- ghsa-coords2 versions
>= 2.0.0, < 2.3.20.1+ 1 more
- (no CPE)range: >= 2.0.0, < 2.3.20.1
- (no CPE)range: >= 2.0.0, < 2.3.20.1
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-q2cg-xf9p-h457ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2015-1831ghsaADVISORY
- struts.apache.org/docs/s2-024.htmlnvdVendor AdvisoryWEB
- github.com/apache/struts/commit/d832747d647df343ed07a58b1b5e540a05a4d51bghsaWEB
- www.securityfocus.com/bid/75940nvd
- www.securitytracker.com/id/1032985nvd
News mentions
0No linked articles in our index yet.