CVE-2025-68493

Katalog CVE

CVSS 8.1 · High EPSS 45,8%

Kerentanan Improper Restriction of XML External Entity Reference pada apache struts. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.

Rincian

Terbit di NVD

11 Januari 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-611: Improper Restriction of XML External Entity Reference
CWE-112: Missing XML Validation

EPSS (30 hari)

45,8% peluang dieksploitasi; lebih tinggi dari 98,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cwiki.apache.org/confluence/display/WW/S2-069 mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/01/11/2 mailing list · advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2025-68493
• https://bugzilla.redhat.com/show_bug.cgi?id=2428559
• https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68493.json