CVE-2016-3082 Remote Code Execution in Apache Struts
CriticalCVSS 9.8
EPSS 19.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.struts/struts2-core(Maven) | < 2.3.20.3 | 2.3.20.3 |
| org.apache.struts/struts2-core(Maven) | >= 2.3.24, < 2.3.24.3 | 2.3.24.3 |
| org.apache.struts/struts2-core(Maven) | >= 2.3.28, < 2.3.28.1 | 2.3.28.1 |
| org.apache.struts/struts2-core(Maven) | = 2.0.11 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.11.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.11.2 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.12 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.14 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.5 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.6 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.8 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.0.9 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.1.2 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.1.6 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.1.8 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.1.8.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.2.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.2.1.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.2.3 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.2.3.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.1.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.1.2 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.12 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.14 | No fix listed |
Show 77 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.struts/struts2-core(Maven) | = 2.3.14.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.14.2 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.14.3 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.15 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.15.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.15.2 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.15.3 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.16 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.16.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.16.2 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.16.3 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.20 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.20.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.3 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.4 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.4.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.7 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.8 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.24 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.24.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.28 | No fix listed |
| apache struts | = 2.0.0 | No fix listed |
| apache struts | = 2.0.1 | No fix listed |
| apache struts | = 2.0.2 | No fix listed |
| apache struts | = 2.0.3 | No fix listed |
| apache struts | = 2.0.4 | No fix listed |
| apache struts | = 2.0.5 | No fix listed |
| apache struts | = 2.0.6 | No fix listed |
| apache struts | = 2.0.7 | No fix listed |
| apache struts | = 2.0.8 | No fix listed |
| apache struts | = 2.0.9 | No fix listed |
| apache struts | = 2.0.10 | No fix listed |
| apache struts | = 2.0.11 | No fix listed |
| apache struts | = 2.0.11.1 | No fix listed |
| apache struts | = 2.0.11.2 | No fix listed |
| apache struts | = 2.0.12 | No fix listed |
| apache struts | = 2.0.13 | No fix listed |
| apache struts | = 2.0.14 | No fix listed |
| apache struts | = 2.1.0 | No fix listed |
| apache struts | = 2.1.1 | No fix listed |
| apache struts | = 2.1.2 | No fix listed |
| apache struts | = 2.1.3 | No fix listed |
| apache struts | = 2.1.4 | No fix listed |
| apache struts | = 2.1.5 | No fix listed |
| apache struts | = 2.1.6 | No fix listed |
| apache struts | = 2.1.8 | No fix listed |
| apache struts | = 2.1.8.1 | No fix listed |
| apache struts | = 2.2.1 | No fix listed |
| apache struts | = 2.2.1.1 | No fix listed |
| apache struts | = 2.2.3 | No fix listed |
| apache struts | = 2.2.3.1 | No fix listed |
| apache struts | = 2.3.1 | No fix listed |
| apache struts | = 2.3.1.1 | No fix listed |
| apache struts | = 2.3.1.2 | No fix listed |
| apache struts | = 2.3.3 | No fix listed |
| apache struts | = 2.3.4 | No fix listed |
| apache struts | = 2.3.4.1 | No fix listed |
| apache struts | = 2.3.7 | No fix listed |
| apache struts | = 2.3.8 | No fix listed |
| apache struts | = 2.3.12 | No fix listed |
| apache struts | = 2.3.14 | No fix listed |
| apache struts | = 2.3.14.1 | No fix listed |
| apache struts | = 2.3.14.2 | No fix listed |
| apache struts | = 2.3.14.3 | No fix listed |
| apache struts | = 2.3.15 | No fix listed |
| apache struts | = 2.3.15.1 | No fix listed |
| apache struts | = 2.3.15.2 | No fix listed |
| apache struts | = 2.3.15.3 | No fix listed |
| apache struts | = 2.3.16 | No fix listed |
| apache struts | = 2.3.16.1 | No fix listed |
| apache struts | = 2.3.16.2 | No fix listed |
| apache struts | = 2.3.16.3 | No fix listed |
| apache struts | = 2.3.20 | No fix listed |
| apache struts | = 2.3.20.1 | No fix listed |
| apache struts | = 2.3.24 | No fix listed |
| apache struts | = 2.3.24.1 | No fix listed |
| apache struts | = 2.3.28 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- struts.apache.org patch vendor-advisory
- github.com
- github.com product
- 88826 vdb-entry
- 1035664 vdb-entry