{"id":"CVE-2025-68493","state":"PUBLISHED","title":"Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component","description":"Missing XML Validation vulnerability in Apache Struts, Apache Struts.\n\nThis issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.\n\nUsers are recommended to upgrade to version 6.1.1, which fixes the issue.","publishedAt":"2026-01-11T13:05:36.894Z","updatedAt":"2026-09-14T12:04:26.312Z","severity":{"score":8.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache Struts"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Struts","packageName":"com.opensymphony:xwork","defaultStatus":"unaffected","versions":[{"version":"2.0.0","status":"affected","lessThan":"2.2.1","versionType":"semver"}],"collectionURL":"https://repo.maven.apache.org/maven2"},{"vendor":"Apache Software Foundation","product":"Apache Struts","packageName":"org.apache.struts.xwork:xwork-core","defaultStatus":"unaffected","versions":[{"version":"2.2.1","status":"affected","lessThanOrEqual":"6.1.0","versionType":"semver"}],"collectionURL":"https://repo.maven.apache.org/maven2"}],"references":["https://cwiki.apache.org/confluence/display/WW/S2-069","http://www.openwall.com/lists/oss-security/2026/01/11/2","https://access.redhat.com/security/cve/CVE-2025-68493","https://bugzilla.redhat.com/show_bug.cgi?id=2428559","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68493.json"],"weaknesses":["CWE-611","CWE-112"],"ingestedAt":"2026-10-29T20:09:56.034Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/68xxx/CVE-2025-68493.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-68493","state":"PUBLISHED","datePublished":"2026-01-11T13:05:36.894Z","dateUpdated":"2026-09-14T12:04:26.312Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2025-12-19T06:50:08.538Z"},"containers":{"cna":{"title":"Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component","descriptions":[{"lang":"en","value":"Missing XML Validation vulnerability in Apache Struts, Apache Struts.\n\nThis issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.\n\nUsers are recommended to upgrade to version 6.1.1, which fixes the issue."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Struts","packageName":"com.opensymphony:xwork","defaultStatus":"unaffected","versions":[{"version":"2.0.0","status":"affected","lessThan":"2.2.1","versionType":"semver"}],"collectionURL":"https://repo.maven.apache.org/maven2"},{"vendor":"Apache Software Foundation","product":"Apache Struts","packageName":"org.apache.struts.xwork:xwork-core","defaultStatus":"unaffected","versions":[{"version":"2.2.1","status":"affected","lessThanOrEqual":"6.1.0","versionType":"semver"}],"collectionURL":"https://repo.maven.apache.org/maven2"}],"references":[{"url":"https://cwiki.apache.org/confluence/display/WW/S2-069","tags":["vendor-advisory"]}],"metrics":[{"other":{"content":{"text":"important"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-611","description":"CWE-611 Improper Restriction of XML External Entity Reference","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2026-03-11T15:11:36.575Z"},"source":{"advisory":"S2-069","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/01/11/2"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-01-11T20:04:11.757Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-01-12T13:52:42.349951Z","id":"CVE-2025-68493","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-12T13:52:58.210Z"}},{"title":"org.apache.struts: Apache Struts: Information disclosure and denial of service via missing XML validation","descriptions":[{"lang":"en","value":"An XML processing flaw has been found in Apache Struts. Parsing of XML configuration in the XWork component does not validate XML in proper way and it's vulnerable to XML external entity (XXE) injection."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"javapackages-tools:201801/google-guice","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"struts2-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"struts2-core","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"struts2-core","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jbosseapxp"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-68493","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2428559","name":"RHBZ#2428559","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68493.json","tags":["x_sadp-csaf-vex"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-112","description":"Missing XML Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-09-14T12:04:26.312Z"},"datePublic":"2026-01-11T13:05:36.894Z","timeline":[{"lang":"en","time":"2026-01-11T14:00:53.880Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-01-11T13:05:36.894Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}