CVE-2015-2992: Apache Struts

Medium severity, CVSS 6.1. EPSS: 5.8% chance of exploitation in the next 30 days.

Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.

Affected products

• Apache Struts: from 2.0.0, before 2.3.20 (fixed in 2.3.20)

Published 2020-02-27. Last modified 2026-06-17.