CVE-2016-0785

HIGH

Apache Struts 2.0.0-2.3.20.3 - Remote Code Execution via Forced Double OGNL Evaluation

Title source: llm

Description

Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1035271

Vendor Advisory x_refsource_confirm

http://struts.apache.org/docs/s2-029.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/85066

Scores

CVSS v3 8.8

EPSS 0.1780

EPSS Percentile 95.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-20

Status published

Products (2)

apache/struts 2.0.0 - 2.3.20.3

org.apache.struts/struts2-core 2.0.0 - 2.3.20.3Maven

Published Apr 12, 2016

Tracked Since Feb 18, 2026