CVE-2016-4438 Arbitrary code execution in Apache Struts 2
CriticalCVSS 9.8
EPSS 16.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.struts/struts2-core(Maven) | >= 2.3.19, < 2.3.29 | 2.3.29 |
| org.apache.struts/struts2-rest-plugin(Maven) | >= 2.3.19, < 2.3.29 | 2.3.29 |
| org.apache.struts/struts2-core(Maven) | = 2.3.20 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.20.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.20.3 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.24 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.24.1 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.24.3 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.28 | No fix listed |
| org.apache.struts/struts2-core(Maven) | = 2.3.28.1 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.20 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.20.1 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.20.3 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.24 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.24.1 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.24.3 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.28 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.28.1 | No fix listed |
| apache struts | = 2.3.20 | No fix listed |
| apache struts | = 2.3.20.1 | No fix listed |
| apache struts | = 2.3.20.3 | No fix listed |
| apache struts | = 2.3.24 | No fix listed |
| apache struts | = 2.3.24.1 | No fix listed |
| apache struts | = 2.3.24.3 | No fix listed |
| apache struts | = 2.3.28 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory vdb-entry
- struts.apache.org vendor-advisory
- JVN#07710476 third-party-advisory vendor-advisory
- JVNDB-2016-000110 third-party-advisory vdb-entry vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com
- github.com product
- www.oracle.com
- 91275 third-party-advisory vdb-entry