{
  "@id": "urn:uuid:56741859-ecdf-4458-ba10-acb1bf5aea34",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-05T18:59:00.218537+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-3093 does not affect version 2.5.33-tuxcare.2 of org.apache.struts:struts2-sitemesh-plugin. not_affected \u2014 Target uses OGNL 3.1.29, which is much newer than the vulnerable versions (< 3.0.12). The vulnerability CVE-2016-3093 stems from improper method reference caching in OGNL before version 3.0.12, causing denial of service through resource exhaustion. The fix was introduced in OGNL 3.0.12 and Struts upgraded to OGNL 3.1.12 in October 2016 (commit 8699f639f). The target's OGNL 3.1.29 includes all f...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-3093"
      },
      "impact_statement": "not_affected \u2014 Target uses OGNL 3.1.29, which is much newer than the vulnerable versions (< 3.0.12). The vulnerability CVE-2016-3093 stems from improper method reference caching in OGNL before version 3.0.12, causing denial of service through resource exhaustion. The fix was introduced in OGNL 3.0.12 and Struts upgraded to OGNL 3.1.12 in October 2016 (commit 8699f639f). The target's OGNL 3.1.29 includes all f..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1327 affects version 2.5.33-tuxcare.2 of org.apache.struts:struts2-sitemesh-plugin.",
      "vulnerability": {
        "name": "CVE-2018-1327"
      },
      "action_statement": "Vulnerability CVE-2018-1327 affects version 2.5.33-tuxcare.2 of org.apache.struts:struts2-sitemesh-plugin."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-53677 is fixed in version 2.5.33-tuxcare.2 of org.apache.struts:struts2-sitemesh-plugin.",
      "vulnerability": {
        "name": "CVE-2024-53677"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-64775 is fixed in version 2.5.33-tuxcare.2 of org.apache.struts:struts2-sitemesh-plugin.",
      "vulnerability": {
        "name": "CVE-2025-64775"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-66675 is fixed in version 2.5.33-tuxcare.2 of org.apache.struts:struts2-sitemesh-plugin.",
      "vulnerability": {
        "name": "CVE-2025-66675"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-68493 is fixed in version 2.5.33-tuxcare.2 of org.apache.struts:struts2-sitemesh-plugin.",
      "vulnerability": {
        "name": "CVE-2025-68493"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-05T18:59:00.218537+00:00",
      "status_notes": "Vulnerability CVE-2026-104711 does not affect version 2.5.33-tuxcare.2 of org.apache.struts:struts2-sitemesh-plugin. not_affected \u2014 Apache Struts 2.5.33 contains the vulnerable RestfulActionMapper code that allows OGNL expression injection leading to RCE, but this component is NOT active in the default configuration. The framework ships with DefaultActionMapper as the default action mapper (struts-default.xml:112), which is not vulnerable. The legacy RestfulActionMapper is only exposed if an application explicitly configure...",
      "vulnerability": {
        "name": "CVE-2026-104711"
      },
      "impact_statement": "not_affected \u2014 Apache Struts 2.5.33 contains the vulnerable RestfulActionMapper code that allows OGNL expression injection leading to RCE, but this component is NOT active in the default configuration. The framework ships with DefaultActionMapper as the default action mapper (struts-default.xml:112), which is not vulnerable. The legacy RestfulActionMapper is only exposed if an application explicitly configure..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-05T18:50:15.032819+00:00",
      "status_notes": "Vulnerability CVE-2026-104712 affects version 2.5.33-tuxcare.2 of org.apache.struts:struts2-sitemesh-plugin.",
      "vulnerability": {
        "name": "CVE-2026-104712"
      },
      "action_statement": "Vulnerability CVE-2026-104712 affects version 2.5.33-tuxcare.2 of org.apache.struts:struts2-sitemesh-plugin."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-05T18:51:00.139198+00:00",
      "status_notes": "Vulnerability CVE-2026-104713 affects version 2.5.33-tuxcare.2 of org.apache.struts:struts2-sitemesh-plugin.",
      "vulnerability": {
        "name": "CVE-2026-104713"
      },
      "action_statement": "Vulnerability CVE-2026-104713 affects version 2.5.33-tuxcare.2 of org.apache.struts:struts2-sitemesh-plugin."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-05T18:51:00.139198+00:00",
      "status_notes": "Vulnerability CVE-2026-104714 affects version 2.5.33-tuxcare.2 of org.apache.struts:struts2-sitemesh-plugin.",
      "vulnerability": {
        "name": "CVE-2026-104714"
      },
      "action_statement": "Vulnerability CVE-2026-104714 affects version 2.5.33-tuxcare.2 of org.apache.struts:struts2-sitemesh-plugin."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.struts/struts2-sitemesh-plugin@2.5.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-73633 affects version 2.5.33-tuxcare.2 of org.apache.struts:struts2-sitemesh-plugin.",
      "vulnerability": {
        "name": "CVE-2026-73633"
      },
      "action_statement": "Vulnerability CVE-2026-73633 affects version 2.5.33-tuxcare.2 of org.apache.struts:struts2-sitemesh-plugin."
    }
  ]
}