{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.3.10"}],"component":"org.apache.struts:struts-extras","cve_ids":["CVE-2025-54656"],"ecosystem":"Maven","epss":0.00671,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-cx25-xg7c-xfm5","id":"tcs_01M5N8THQ8A7D7SQ9TFM5TR55Z","modified_at":"2025-11-14T23:09:54.325221Z","published_at":"2025-07-30T18:31:36Z","references":["https://osv.dev/vulnerability/GHSA-cx25-xg7c-xfm5","https://nvd.nist.gov/vuln/detail/CVE-2025-54656","https://github.com/apache/struts","https://lists.apache.org/thread/so5cn07j2zn9vlf1xnfqp630wts719rr","http://www.openwall.com/lists/oss-security/2025/07/30/1"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-cx25-xg7c-xfm5","url":"https://osv.dev/vulnerability/GHSA-cx25-xg7c-xfm5"}],"summary":"Apache Struts Extras Before 2 has an Improper Output Neutralization for Logs Vulnerability"}