{ "@id": "urn:uuid:7248894c-d042-4971-871b-edbbd6807be4", "role": "Document Creator", "author": "https://tuxcare.com", "version": 5, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T15:05:51.407283+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.struts/struts-parent@1.3.5-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.struts/struts-parent@1.3.5-tuxcare.1" } } ], "timestamp": "2026-11-04T12:27:00.053879+00:00", "status_notes": "Vulnerability CVE-2012-0391 does not affect version 1.3.5-tuxcare.1 of org.apache.struts:struts-parent. Struts 1.3.5 is not vulnerable to CVE-2012-0391. No backport is needed. CVE-2012-0391 (WW-3668) is a Struts 2/XWork flaw: GHSA-4wrr-9h5r-m92w lists only struts2-core and xwork-core < 2.2.3.1, and the upstream fix (apache/struts b4265d36, 25e50069) touches only Struts 2 core and xwork-core classes. Struts 1.3.5 has no OGNL or XWork code. This is a false match: NVD removed the 2.0.0 lower bound from cpe:2.3:a:apache:struts on 2025-03-12, so Struts 1.x now falls inside the range.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-0391" }, "impact_statement": "Struts 1.3.5 is not vulnerable to CVE-2012-0391. No backport is needed. CVE-2012-0391 (WW-3668) is a Struts 2/XWork flaw: GHSA-4wrr-9h5r-m92w lists only struts2-core and xwork-core < 2.2.3.1, and the upstream fix (apache/struts b4265d36, 25e50069) touches only Struts 2 core and xwork-core classes. Struts 1.3.5 has no OGNL or XWork code. This is a false match: NVD removed the 2.0.0 lower bound from cpe:2.3:a:apache:struts on 2025-03-12, so Struts 1.x now falls inside the range." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.struts/struts-parent@1.3.5-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.struts/struts-parent@1.3.5-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4431 does not affect version 1.3.5-tuxcare.1 of org.apache.struts:struts-parent. CVE-2016-4431 (Apache advisory S2-040) is a flaw in Apache Struts 2, affecting versions 2.3.20 through 2.3.28.1 and fixed in 2.3.29 and 2.5.1. It works through Struts 2's request-to-action resolution: DefaultActionMapper derives the action name - and, in the ! form, a method - from the request URI and validates it only against the struts.allowed.action.names regular expression, falling back to a default action when it does not match. A crafted request can use that gap to reach a default or getter-style action method and to manipulate the result string the action returns, so the framework redirects the user to an unvalidated location. The advisory's mitigation, narrowing struts.allowed.action.names, shows where the flaw lives. This release is Apache Struts 1: org.apache.struts:struts-parent 1.3.5, built from the struts1 source tree under the org.apache.struts:struts-master parent, with a completely different request pipeline. org.apache.struts.action.ActionServlet and RequestProcessor take only the request path, resolve it against an ActionMapping declared in struts-config.xml, and invoke the single Action.execute(ActionMapping, ActionForm, ...) entry point; navigation targets are ActionForward and ActionRedirect objects built from that same configuration. There is no action-name pattern, no action method selected from the request URI, no default or getter action method, and no result string a client can steer into a redirect. Nor is the Struts 2 code present in any other form. The reactor consists solely of the Struts 1 modules - core, el, extras, faces, mailreader-dao, scripting, taglib, tiles - and org.apache.struts in the sources contains only the action, chain, config, upload, util and validator packages. No module declares a dependency on struts2-core, xwork or any com.opensymphony artifact, and no Struts 2 sources are vendored or shaded into the build. The mechanism the advisory describes has no counterpart anywhere in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4431" }, "impact_statement": "CVE-2016-4431 (Apache advisory S2-040) is a flaw in Apache Struts 2, affecting versions 2.3.20 through 2.3.28.1 and fixed in 2.3.29 and 2.5.1. It works through Struts 2's request-to-action resolution: DefaultActionMapper derives the action name - and, in the ! form, a method - from the request URI and validates it only against the struts.allowed.action.names regular expression, falling back to a default action when it does not match. A crafted request can use that gap to reach a default or getter-style action method and to manipulate the result string the action returns, so the framework redirects the user to an unvalidated location. The advisory's mitigation, narrowing struts.allowed.action.names, shows where the flaw lives. This release is Apache Struts 1: org.apache.struts:struts-parent 1.3.5, built from the struts1 source tree under the org.apache.struts:struts-master parent, with a completely different request pipeline. org.apache.struts.action.ActionServlet and RequestProcessor take only the request path, resolve it against an ActionMapping declared in struts-config.xml, and invoke the single Action.execute(ActionMapping, ActionForm, ...) entry point; navigation targets are ActionForward and ActionRedirect objects built from that same configuration. There is no action-name pattern, no action method selected from the request URI, no default or getter action method, and no result string a client can steer into a redirect. Nor is the Struts 2 code present in any other form. The reactor consists solely of the Struts 1 modules - core, el, extras, faces, mailreader-dao, scripting, taglib, tiles - and org.apache.struts in the sources contains only the action, chain, config, upload, util and validator packages. No module declares a dependency on struts2-core, xwork or any com.opensymphony artifact, and no Struts 2 sources are vendored or shaded into the build. The mechanism the advisory describes has no counterpart anywhere in this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.struts/struts-parent@1.3.5-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.struts/struts-parent@1.3.5-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-34149 affects version 1.3.5-tuxcare.1 of org.apache.struts:struts-parent.", "vulnerability": { "name": "CVE-2023-34149" }, "action_statement": "Vulnerability CVE-2023-34149 affects version 1.3.5-tuxcare.1 of org.apache.struts:struts-parent." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.struts/struts-parent@1.3.5-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.struts/struts-parent@1.3.5-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47466 does not affect version 1.3.5-tuxcare.1 of org.apache.struts:struts-parent. not_affected \u2014 The target repository (Apache Struts 1.3.5-tuxcare.1, a Java web application framework) is not affected by CVE-2023-47466. The CVE describes a vulnerability in TagLib (a C++ audio metadata library) related to RIFF/WAV file processing. These are completely different projects that happen to share the name 'taglib' but serve entirely different purposes: TagLib (C++) processes audio file metadata, ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47466" }, "impact_statement": "not_affected \u2014 The target repository (Apache Struts 1.3.5-tuxcare.1, a Java web application framework) is not affected by CVE-2023-47466. The CVE describes a vulnerability in TagLib (a C++ audio metadata library) related to RIFF/WAV file processing. These are completely different projects that happen to share the name 'taglib' but serve entirely different purposes: TagLib (C++) processes audio file metadata, ..." } ] }