CVE-2016-4431 Apache Struts Access Control Redirect
HighCVSS 7.5
EPSS 9.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.struts/struts-parent(Maven) | >= 2.3.20, <= 2.3.28.1 | No fix listed |
| org.apache.struts/struts-parent(Maven) | >= 2.3.20, < 2.3.29 | 2.3.29 |
| apache struts | = 2.3.20 | No fix listed |
| apache struts | = 2.3.20.1 | No fix listed |
| apache struts | = 2.3.20.3 | No fix listed |
| apache struts | = 2.3.24 | No fix listed |
| apache struts | = 2.3.24.1 | No fix listed |
| apache struts | = 2.3.24.3 | No fix listed |
| apache struts | = 2.3.28 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking
- struts.apache.org vendor-advisory
- JVN#45093481 third-party-advisory vendor-advisory
- JVNDB-2016-000113 third-party-advisory vdb-entry vendor-advisory
- www-01.ibm.com third-party-advisory
- www-01.ibm.com third-party-advisory
- www.oracle.com
- web.archive.org
- github.com patch
- github.com
- github.com product
- 91284 vdb-entry