CVE-2016-4433 Apache Struts Open Redirect
HighCVSS 7.5
EPSS 9.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.struts.xwork/xwork-core(Maven) | >= 2.3.20, < 2.3.29 | 2.3.29 |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.3.20 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.3.20.1 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.3.20.3 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.3.24 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.3.24.1 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.3.24.3 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.3.28 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | = 2.3.28.1 | No fix listed |
| org.apache.struts.xwork/xwork-core(Maven) | >= 2.3.20, <= 2.3.28.1 | No fix listed |
| apache struts | = 2.3.20 | No fix listed |
| apache struts | = 2.3.20.1 | No fix listed |
| apache struts | = 2.3.20.3 | No fix listed |
| apache struts | = 2.3.24 | No fix listed |
| apache struts | = 2.3.24.1 | No fix listed |
| apache struts | = 2.3.24.3 | No fix listed |
| apache struts | = 2.3.28 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- bugzilla.redhat.com issue-tracking
- github.com product
- struts.apache.org vendor-advisory
- web.archive.org
- JVN#45093481 third-party-advisory vendor-advisory
- JVNDB-2016-000112 third-party-advisory vdb-entry vendor-advisory
- www-01.ibm.com third-party-advisory
- www-01.ibm.com third-party-advisory
- www.oracle.com
- github.com
- 91282 vdb-entry