CVE-2015-2992: 
Java vulnerability analysis and mitigation

Apache Struts versions prior to 2.3.20 contain a cross-site scripting (XSS) vulnerability that affects directly accessible JSP files. The vulnerability was discovered and reported by Takayoshi Isayama of Mitsui Bussan Secure Directions, Inc. to IPA, and JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership (JVN Advisory, JVNDB).

The vulnerability exists when JSP files can be accessed directly in Apache Struts, a software framework for creating web applications in Java. The CVSS v3.1 base score is 6.1 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility with low attack complexity but requiring user interaction (NVD).

When successfully exploited, this vulnerability allows an attacker to execute arbitrary scripts on the user's Internet Explorer browser when the XSS filter is turned off. This can lead to unauthorized access to and modification of data accessible through the vulnerable application (JVN Advisory).

The following mitigations are recommended: 1) Update Apache Struts to version 2.3.20 or later, 2) Place JSP files under the 'WEB-INF' folder to avoid direct access, 3) Add a security constraint to the web.xml file (JVN Advisory).