{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ba86400c-f7be-5565-bd0e-7ed21032c374", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.apache.struts/struts-extras@1.3.5-tuxcare.1", "type": "library", "group": "org.apache.struts", "name": "struts-extras", "version": "1.3.5-tuxcare.1", "purl": "pkg:maven/org.apache.struts/struts-extras@1.3.5-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e60b2d80-75c4-58cf-a9d4-2f9ddd10ecb7", "id": "CVE-2012-0391", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-0391 affects version 1.3.5-tuxcare.1 of org.apache.struts:struts-extras." }, "affects": [ { "ref": "pkg:maven/org.apache.struts/struts-extras@1.3.5-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b49665f4-902f-52bb-b592-995957510ff7", "id": "CVE-2012-1007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2012-1007 is fixed in version 1.3.5-tuxcare.1 of org.apache.struts:struts-extras." }, "affects": [ { "ref": "pkg:maven/org.apache.struts/struts-extras@1.3.5-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8cbb46c4-2411-5847-888e-d5f5e14ceb4b", "id": "CVE-2014-0114", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-0114 is fixed in version 1.3.5-tuxcare.1 of org.apache.struts:struts-extras." }, "affects": [ { "ref": "pkg:maven/org.apache.struts/struts-extras@1.3.5-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9d98a24d-d2ab-5d02-abf9-bd96e6422408", "id": "CVE-2015-0899", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-0899 is fixed in version 1.3.5-tuxcare.1 of org.apache.struts:struts-extras." }, "affects": [ { "ref": "pkg:maven/org.apache.struts/struts-extras@1.3.5-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b1f097ee-18bd-5b7e-af6a-1ee8612778c8", "id": "CVE-2016-1181", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-1181 is fixed in version 1.3.5-tuxcare.1 of org.apache.struts:struts-extras." }, "affects": [ { "ref": "pkg:maven/org.apache.struts/struts-extras@1.3.5-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c2115165-5f93-55f7-88d5-051a8c71860d", "id": "CVE-2016-1182", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-1182 is fixed in version 1.3.5-tuxcare.1 of org.apache.struts:struts-extras." }, "affects": [ { "ref": "pkg:maven/org.apache.struts/struts-extras@1.3.5-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e5a8af4f-8e31-5579-9c3e-79542b646237", "id": "CVE-2016-4431", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-4431 does not affect version 1.3.5-tuxcare.1 of org.apache.struts:struts-extras. CVE-2016-4431 (Apache advisory S2-040) is a flaw in Apache Struts 2, affecting versions 2.3.20 through 2.3.28.1 and fixed in 2.3.29 and 2.5.1. It works through Struts 2's request-to-action resolution: DefaultActionMapper derives the action name - and, in the ! form, a method - from the request URI and validates it only against the struts.allowed.action.names regular expression, falling back to a default action when it does not match. A crafted request can use that gap to reach a default or getter-style action method and to manipulate the result string the action returns, so the framework redirects the user to an unvalidated location. The advisory's mitigation, narrowing struts.allowed.action.names, shows where the flaw lives. This release is Apache Struts 1: org.apache.struts:struts-parent 1.3.5, built from the struts1 source tree under the org.apache.struts:struts-master parent, with a completely different request pipeline. org.apache.struts.action.ActionServlet and RequestProcessor take only the request path, resolve it against an ActionMapping declared in struts-config.xml, and invoke the single Action.execute(ActionMapping, ActionForm, ...) entry point; navigation targets are ActionForward and ActionRedirect objects built from that same configuration. There is no action-name pattern, no action method selected from the request URI, no default or getter action method, and no result string a client can steer into a redirect. Nor is the Struts 2 code present in any other form. The reactor consists solely of the Struts 1 modules - core, el, extras, faces, mailreader-dao, scripting, taglib, tiles - and org.apache.struts in the sources contains only the action, chain, config, upload, util and validator packages. No module declares a dependency on struts2-core, xwork or any com.opensymphony artifact, and no Struts 2 sources are vendored or shaded into the build. The mechanism the advisory describes has no counterpart anywhere in this version." }, "affects": [ { "ref": "pkg:maven/org.apache.struts/struts-extras@1.3.5-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:72c644f3-b050-51fa-9446-00448c7d0eea", "id": "CVE-2020-26258", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-26258 is a false positive for org.apache.struts:struts-extras 1.3.5-tuxcare.1. false_positive \u2014 CVE-2020-26258 affects XStream library (com.thoughtworks.xstream), not Apache Struts. The target repository is Apache Struts 1.3.5-tuxcare.1, which does not use, bundle, or depend on XStream. XStream is explicitly excluded from the only dependency that references it (groovy-all in apps/scripting-mailreader/pom.xml lines 151-154). No XStream code, imports, or API usage exists in the 640 Java fil..." }, "affects": [ { "ref": "pkg:maven/org.apache.struts/struts-extras@1.3.5-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9da0d85a-884d-5a11-b74e-624d0b161159", "id": "CVE-2020-26259", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26259 affects version 1.3.5-tuxcare.1 of org.apache.struts:struts-extras." }, "affects": [ { "ref": "pkg:maven/org.apache.struts/struts-extras@1.3.5-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a011d53b-71df-5a93-9d20-87736b0dd516", "id": "CVE-2023-34149", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34149 affects version 1.3.5-tuxcare.1 of org.apache.struts:struts-extras." }, "affects": [ { "ref": "pkg:maven/org.apache.struts/struts-extras@1.3.5-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c96602b0-17ae-5c26-ad76-447586dd7c2b", "id": "CVE-2023-34396", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34396 affects version 1.3.5-tuxcare.1 of org.apache.struts:struts-extras." }, "affects": [ { "ref": "pkg:maven/org.apache.struts/struts-extras@1.3.5-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:514d5f10-ca78-5057-bfd6-ba9f805d2d0a", "id": "CVE-2023-47466", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-47466 does not affect version 1.3.5-tuxcare.1 of org.apache.struts:struts-extras. not_affected \u2014 The target repository (Apache Struts 1.3.5-tuxcare.1, a Java web application framework) is not affected by CVE-2023-47466. The CVE describes a vulnerability in TagLib (a C++ audio metadata library) related to RIFF/WAV file processing. These are completely different projects that happen to share the name 'taglib' but serve entirely different purposes: TagLib (C++) processes audio file metadata, ..." }, "affects": [ { "ref": "pkg:maven/org.apache.struts/struts-extras@1.3.5-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d5cae739-e651-5c30-85a9-8ad2032a0a6a", "id": "CVE-2023-49735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-49735 affects version 1.3.5-tuxcare.1 of org.apache.struts:struts-extras." }, "affects": [ { "ref": "pkg:maven/org.apache.struts/struts-extras@1.3.5-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:56eabdce-1839-52d8-8cfb-f6a8cf304ce3", "id": "CVE-2025-54656", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-54656 is fixed in version 1.3.5-tuxcare.1 of org.apache.struts:struts-extras." }, "affects": [ { "ref": "pkg:maven/org.apache.struts/struts-extras@1.3.5-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.apache.struts/struts-extras@1.3.5-tuxcare.1" } ] }