CVE-2016-3090 Apache Struts RCE Vulnerability

HighCVSS 8.8 EPSS 5.7%

Published: 2017-10-30 16:00
Updated: 2026-06-17 03:44
Exploit status: No public exploit known

Description

The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.

Affected products

Product	Affected versions	Fixed in
org.apache.struts/struts2-parent(Maven)	>= 2.0.0, < 2.3.20	2.3.20
org.apache.struts/struts2-parent(Maven)	= 2.0.11	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.0.11.1	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.0.11.2	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.0.12	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.0.14	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.0.5	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.0.6	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.0.8	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.0.9	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.1.2	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.1.6	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.1.8	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.1.8.1	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.2.1	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.2.1.1	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.2.3	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.2.3.1	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.1	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.1.1	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.1.2	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.12	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.14	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.14.1	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.14.2	No fix listed

Show 73 more

Product	Affected versions	Fixed in
org.apache.struts/struts2-parent(Maven)	= 2.3.14.3	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.15	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.15.1	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.15.2	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.15.3	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.16	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.16.1	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.16.2	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.16.3	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.3	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.4	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.4.1	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.7	No fix listed
org.apache.struts/struts2-parent(Maven)	= 2.3.8	No fix listed
apache struts	= 2.0.1	No fix listed
apache struts	= 2.0.2	No fix listed
apache struts	= 2.0.3	No fix listed
apache struts	= 2.0.4	No fix listed
apache struts	= 2.0.5	No fix listed
apache struts	= 2.0.6	No fix listed
apache struts	= 2.0.7	No fix listed
apache struts	= 2.0.8	No fix listed
apache struts	= 2.0.9	No fix listed
apache struts	= 2.0.10	No fix listed
apache struts	= 2.0.11	No fix listed
apache struts	= 2.0.11.1	No fix listed
apache struts	= 2.0.11.2	No fix listed
apache struts	= 2.0.12	No fix listed
apache struts	= 2.0.13	No fix listed
apache struts	= 2.0.14	No fix listed
apache struts	= 2.1.0	No fix listed
apache struts	= 2.1.1	No fix listed
apache struts	= 2.1.2	No fix listed
apache struts	= 2.1.3	No fix listed
apache struts	= 2.1.4	No fix listed
apache struts	= 2.1.5	No fix listed
apache struts	= 2.1.6	No fix listed
apache struts	= 2.1.7	No fix listed
apache struts	= 2.1.8	No fix listed
apache struts	= 2.1.8.1	No fix listed
apache struts	= 2.2.1	No fix listed
apache struts	= 2.2.1.1	No fix listed
apache struts	= 2.2.3	No fix listed
apache struts	= 2.2.3.1	No fix listed
apache struts	= 2.3.1	No fix listed
apache struts	= 2.3.1.1	No fix listed
apache struts	= 2.3.1.2	No fix listed
apache struts	= 2.3.3	No fix listed
apache struts	= 2.3.4	No fix listed
apache struts	= 2.3.4.1	No fix listed
apache struts	= 2.3.5	No fix listed
apache struts	= 2.3.6	No fix listed
apache struts	= 2.3.7	No fix listed
apache struts	= 2.3.8	No fix listed
apache struts	= 2.3.9	No fix listed
apache struts	= 2.3.10	No fix listed
apache struts	= 2.3.11	No fix listed
apache struts	= 2.3.12	No fix listed
apache struts	= 2.3.13	No fix listed
apache struts	= 2.3.14	No fix listed
apache struts	= 2.3.14.1	No fix listed
apache struts	= 2.3.14.2	No fix listed
apache struts	= 2.3.14.3	No fix listed
apache struts	= 2.3.15	No fix listed
apache struts	= 2.3.15.1	No fix listed
apache struts	= 2.3.15.2	No fix listed
apache struts	= 2.3.15.3	No fix listed
apache struts	= 2.3.16	No fix listed
apache struts	= 2.3.16.1	No fix listed
apache struts	= 2.3.16.2	No fix listed
apache struts	= 2.3.16.3	No fix listed
apache struts	= 2.3.17	No fix listed
apache struts	= 2.3.19	No fix listed

References

nvd.nist.gov third-party-advisory vendor-advisory
security.netapp.com
struts.apache.org vendor-advisory
web.archive.org
web.archive.org
github.com
github.com product
85131 third-party-advisory vdb-entry
1035267 third-party-advisory vdb-entry

CVSS v3.0

8.8 High

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

All scores (4)

v3.0 8.8 · nvd@nist.gov
v3.0 8.8 · osv:ghsa
v3.0 8.8 · github
v2.0 6.5 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 5.71% (percentile 93.1)
CWE: CWE-20 Improper Input Validation

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.