CVE-2011-3923: Apache Struts

Critical severity, CVSS 9.8. EPSS: 89.5% chance of exploitation in the next 30 days.

Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.

Affected products

• Apache Struts: from 2.0.0, before 2.3.1.2 (fixed in 2.3.1.2)
• Red Hat JBoss Enterprise Web Server: version 1.0.0 only

Published 2019-11-01. Last modified 2026-06-16.