GitHub Advisoryadvisory · Maven

GHSA-8c6j-ffmf-q6vm Apache Struts RCE Vulnerability

HIGH Published 2022-05-14 Modified 2023-11-01 Official page ↗
Aliases
CVE-2016-3081
Ecosystem
Maven
Packages
org.apache.struts:struts2-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77
Reviewed
2023-07-28

Affected packages

• Maven org.apache.struts:struts2-core: >= 2.3.19, < 2.3.20.3 → fixed in 2.3.20.3 • Maven org.apache.struts:struts2-core: >= 2.3.21, < 2.3.24.3 → fixed in 2.3.24.3 • Maven org.apache.struts:struts2-core: >= 2.3.25, < 2.3.28.1 → fixed in 2.3.28.1

Description

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

Related

Alias · CVE (1)

  • CVE-2016-3081 Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote… vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References