VulnerabilityModified
CVE-2019-0233
An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.
HIGH 7.5EPSS 66.1%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 66.1%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 66.15% probability · 99th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-281
- Affected
- apache/struts · oracle/communications policy management · oracle/financial services data integration hub · oracle/financial services market risk measurement and management · oracle/mysql enterprise monitor
- Source
- security@apache.org
EPSS moved from 66.1% on 2 October 2026 to 66.1% on 27 October 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.
References
- https://cwiki.apache.org/confluence/display/ww/s2-060Vendor Advisory
- https://launchpad.support.sap.com/#/notes/2982840Permissions Required, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
- https://cwiki.apache.org/confluence/display/ww/s2-060Vendor Advisory
- https://launchpad.support.sap.com/#/notes/2982840Permissions Required, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.