CVE-2016-3082

CRITICAL

Apache Struts 2.x Remote Code Execution via XSLTResult Stylesheet Location

Title source: llm

Description

XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/88826

Patch, Vendor Advisory x_refsource_confirm

http://struts.apache.org/docs/s2-031.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1035664

Scores

CVSS v3 9.8

EPSS 0.2463

EPSS Percentile 96.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-20

Status published

Products (50)

apache/struts 2.0.0

apache/struts 2.0.1

apache/struts 2.0.2

apache/struts 2.0.3

apache/struts 2.0.4

apache/struts 2.0.5

apache/struts 2.0.6

apache/struts 2.0.7

apache/struts 2.0.8

apache/struts 2.0.9

... and 40 more

Published Apr 26, 2016

Tracked Since Feb 18, 2026