{"action":"opened","issue":{"url":"https://api.github.com/repos/depshield-ci/ci-project-20/issues/35","repository_url":"https://api.github.com/repos/depshield-ci/ci-project-20","labels_url":"https://api.github.com/repos/depshield-ci/ci-project-20/issues/35/labels{/name}","comments_url":"https://api.github.com/repos/depshield-ci/ci-project-20/issues/35/comments","events_url":"https://api.github.com/repos/depshield-ci/ci-project-20/issues/35/events","html_url":"https://github.com/depshield-ci/ci-project-20/issues/35","id":378990395,"node_id":"MDU6SXNzdWUzNzg5OTAzOTU=","number":35,"title":"[DepShield] Vulnerability due to usage of org.apache.struts:struts2-core:2.3.1","user":{"login":"sonatype-depshield-ci[bot]","id":41704551,"node_id":"MDM6Qm90NDE3MDQ1NTE=","avatar_url":"https://avatars2.githubusercontent.com/u/39319176?v=4","gravatar_id":"","url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D","html_url":"https://github.com/apps/sonatype-depshield-ci","followers_url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-11-09T01:48:24Z","updated_at":"2018-11-09T01:48:24Z","closed_at":null,"author_association":"NONE","body":"DepShield reports that this application's usage of [org.apache.struts:struts2-core:2.3.1](https://ossindex-stage.sonatype.org/component/pkg:maven/org.apache.struts/struts2-core@2.3.1) results in the following vulnerability(s):\n\n- (CVSS **10.0**) [[CVE-2013-4316]  null, Improper Access Control](https://ossindex-stage.sonatype.org/vuln/55824e1f-d3fa-4b4f-a2d2-ff50854377e5)\n- (CVSS **9.8**) [[CVE-2016-4436] Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have uns...](https://ossindex-stage.sonatype.org/vuln/7859e35c-50f4-4001-a3ad-93d93aa1edb9)\n- (CVSS **9.8**) [[CVE-2016-3082]  Improper Input Validation](https://ossindex-stage.sonatype.org/vuln/fb730d18-a43f-4357-af53-83080a9c2d5e)\n- (CVSS **9.8**) [[CVE-2017-12611] In Apache Struts 2.0.1 through 2.3.33 and 2.5 through 2.5.10, using an unintenti...](https://ossindex-stage.sonatype.org/vuln/fbaa4ce7-686a-406a-b995-828ee61dfdb2)\n- (CVSS **9.8**) [[CVE-2018-11776] Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remo...](https://ossindex-stage.sonatype.org/vuln/30e3f959-e906-47ae-9601-1f9b9c84e59d)\n- (CVSS **9.3**) [[CVE-2013-2134]  Improper Control of Generation of Code (\"Code Injection\")](https://ossindex-stage.sonatype.org/vuln/c407b589-ad93-4e0a-92ab-047e3eb70f93)\n- (CVSS **9.3**) [[CVE-2013-2135]  Improper Control of Generation of Code (\"Code Injection\")](https://ossindex-stage.sonatype.org/vuln/16cf1a42-25c0-41c2-8c34-c7be29b43a36)\n- (CVSS **9.3**) [[CVE-2013-1966]  Improper Control of Generation of Code (\"Code Injection\")](https://ossindex-stage.sonatype.org/vuln/a0657f56-d1ef-4515-90e9-458cd38bd41c)\n- (CVSS **9.3**) [[CVE-2013-2115]  Improper Control of Generation of Code (\"Code Injection\")](https://ossindex-stage.sonatype.org/vuln/37ab4f59-71df-4b56-aef1-9bfe28ca79a2)\n- (CVSS **9.3**) [[CVE-2013-2251]  Improper Input Validation](https://ossindex-stage.sonatype.org/vuln/d27e9fb2-4e05-4cc0-b29d-94486330fd9c)\n- (CVSS **8.8**) [[CVE-2016-4461] Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary cod...](https://ossindex-stage.sonatype.org/vuln/a2a07f42-99ae-460e-b84b-66730b791889)\n- (CVSS **8.8**) [[CVE-2016-3090] The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 a...](https://ossindex-stage.sonatype.org/vuln/011dc503-5d1a-45e8-8b58-256834f386e4)\n- (CVSS **8.8**) [[CVE-2016-0785]  Improper Input Validation](https://ossindex-stage.sonatype.org/vuln/da1591c9-509d-4696-be11-bfc31ccf6c85)\n- (CVSS **8.1**) [[CVE-2016-3081]  Improper Neutralization of Special Elements used in a Command (Command Injection)](https://ossindex-stage.sonatype.org/vuln/4c84a673-d0e4-40a1-bbc4-b738b96140f0)\n- (CVSS **7.5**) [[CVE-2014-0112]  Permissions, Privileges, and Access Controls](https://ossindex-stage.sonatype.org/vuln/9e5594d3-7d12-4a48-a94e-bd50a0d922da)\n- (CVSS **7.5**) [[CVE-2014-0113]  Permissions, Privileges, and Access Controls](https://ossindex-stage.sonatype.org/vuln/56b65116-2a4d-4b1c-b72e-10572aa7cd29)\n- (CVSS **7.5**) [[CVE-2015-5209]  Improper Input Validation](https://ossindex-stage.sonatype.org/vuln/4a9b9a9c-32e7-4f81-8803-60d852353648)\n- (CVSS **6.8**) [[CVE-2014-7809]  Cross-Site Request Forgery (CSRF)](https://ossindex-stage.sonatype.org/vuln/5db4ea61-d976-4ddd-9fdc-f8f07921eba4)\n- (CVSS **6.8**) [[CVE-2012-4386]  Cross-Site Request Forgery (CSRF)](https://ossindex-stage.sonatype.org/vuln/90cbb22b-f9d8-4be1-9a1f-43f7cb844ca2)\n- (CVSS **6.4**) [[CVE-2012-0393]  Permissions, Privileges, and Access Controls](https://ossindex-stage.sonatype.org/vuln/b02d719a-7037-43e4-af45-5765d1decfa0)\n- (CVSS **6.1**) [[CVE-2016-2162]  Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")](https://ossindex-stage.sonatype.org/vuln/0fdda8a6-360e-4ebf-8036-18f0ff85ad6f)\n- (CVSS **6.1**) [CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://ossindex-stage.sonatype.org/vuln/8d360eae-7285-4e8a-b609-7413e4e053d5)\n- (CVSS **6.1**) [[CVE-2015-5169] Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.](https://ossindex-stage.sonatype.org/vuln/dc5a498b-6bea-46bf-81e0-3618ed87b33a)\n- (CVSS **6.1**) [[CVE-2016-4003]  Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")](https://ossindex-stage.sonatype.org/vuln/decf2418-0b6e-4b18-9964-81db83c81092)\n- (CVSS **5.8**) [[CVE-2013-4310]  Permissions, Privileges, and Access Controls](https://ossindex-stage.sonatype.org/vuln/9a99aea9-0c07-4e13-acb2-d6bbb15e2c93)\n- (CVSS **5.8**) [[CVE-2014-0116]  Permissions, Privileges, and Access Controls](https://ossindex-stage.sonatype.org/vuln/41e89c7d-b7da-447c-9531-cbbd914fd176)\n- (CVSS **5.8**) [[CVE-2013-2248]  Improper Input Validation](https://ossindex-stage.sonatype.org/vuln/6d5755c0-6bfb-4aeb-95ce-ea9e162831f0)\n- (CVSS **5.3**) [[CVE-2016-3093]  Improper Input Validation](https://ossindex-stage.sonatype.org/vuln/c91291be-295b-457b-88ec-9abca565abec)\n- (CVSS **5.0**) [[CVE-2014-0094] The ParametersInterceptor in Apache Struts before 2.3.16.1 allows remote attacke...](https://ossindex-stage.sonatype.org/vuln/9fdb2f25-9442-442d-97e3-ec16f2682521)\n- (CVSS **5.0**) [[CVE-2012-4387]  Permissions, Privileges, and Access Controls](https://ossindex-stage.sonatype.org/vuln/7c28a59a-6b05-4620-8c55-6093d497a955)\n\n<sub>This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for [personal](https://help.github.com/articles/managing-your-personal-account-s-apps/) and [organization](https://help.github.com/articles/managing-your-organization-s-apps/) accounts. Please submit questions or feedback about DepShield to the [Sonatype DepShield Community](https://community.sonatype.com/c/depshield).</sub>"}}
{"actor":{"display_login":"sonatype-depshield-ci"}}