CVE-2019-0233: Apache Struts file upload access permission override denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.5 with network reachability, no authentication and high EPSS make this a serious availability risk, though it is not known to be actively exploited.

What it is

Apache Struts 2.0.0 through 2.5.20 contains an access permission override flaw that can be triggered during file upload, resulting in a denial of service. The vulnerability is remotely reachable without authentication or user interaction, so any exposed Struts upload endpoint is a potential target.

Impact

An unauthenticated remote attacker can cause a denial of service, disrupting availability of the affected Struts application. There is no stated impact to confidentiality or integrity.

Attack surface

Reached over the network via HTTP against a Struts file upload endpoint; the CVSS vector indicates no privileges and no user interaction are required. No further detail on the exact request shape is provided in the record.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is high at 0.6805 (99.29th percentile), indicating elevated likelihood of attempted exploitation. References are vendor advisories and Oracle patch notices, with no public exploit tag supplied.

What to do

• Upgrade Apache Struts to a version above 2.5.20 per the S2-060 vendor advisory.
• Apply the referenced Oracle CPU patches for bundled Struts components in Oracle products.
• Restrict or disable unnecessary file upload endpoints and limit upload size where uploads are not required.
• Place affected applications behind rate limiting and request filtering to blunt denial-of-service attempts.
• Monitor vendor advisories for updated guidance on affected Struts versions.

Detection

• Alert on abnormal volumes or sizes of multipart/form-data upload requests to Struts endpoints.
• Monitor application and web server logs for upload-related errors, timeouts or resource exhaustion.
• Track availability and response-time degradation on hosts running Struts 2.0.0 to 2.5.20.
• Correlate repeated unauthenticated upload attempts from single sources against the same endpoint.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.