GitHub Advisoryadvisory · Maven

GHSA-383p-xqxx-rrmp Denial of service in Apache Struts

MEDIUM Published 2022-05-17 Modified 2024-03-14 Official page ↗
Aliases
CVE-2016-3093
Ecosystem
Maven
Packages
org.apache.struts:struts2-core, ognl:ognl
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-20
Reviewed
2022-07-06

Affected packages

• Maven org.apache.struts:struts2-core: >= 2.0.0, < 2.3.24.3 → fixed in 2.3.24.3 • Maven ognl:ognl: < 3.0.12 → fixed in 3.0.12

Description

Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2016-3093 Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References