Security Bulletin:IBM TRIRIGA Application Platform discloses CVE-2016-3093

Summary IBM TRIRIGA Application Platform discloses CVE-2016-3093 Vulnerability Details CVEID:CVE-2016-3093 DESCRIPTION: Apache Struts is vulnerable to a denial of service, caused by the improper implementation of cache used to store method references by the OGNL expression language. An attacker...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8) +232 more potentially affected by CVE-2016-3093 via org.apache.struts:struts2-core (>=2.0.5, <=2.3.24.1)

org.apache.struts:struts2-core MAVEN version =2.0.5, =2.0.0, =1.2.1, =1.5.3, =1.5.3, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =1.0, =1.0, =1.0, =1.0, =1.0.4 and more Source cves: CVE-2016-3093 Source advisory: GHSA-383P-XQXX-RRMP...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8) +232 more potentially affected by CVE-2016-3093 via org.apache.struts:struts2-core (>=2.0.5, <=2.3.24.1)

org.apache.struts:struts2-core MAVEN version =2.0.5, =2.0.0, =1.2.1, =1.5.3, =1.5.3, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =1.0, =1.0, =1.0, =1.0, =1.0.4 and more Source cves: CVE-2016-3093 Source advisory: OSV:GHSA-383P-XQXX-RRMP...

info.kfgodel:bean2bean (>=1.1.5, <=1.1.6), net.sf.tacos:beanform (>=0.8, <=0.9) +12 more potentially affected by CVE-2016-3093 via ognl:ognl (2.7)

ognl:ognl MAVEN version 2.7 is affected by a known vulnerability. The following packages have a transitive dependency on ognl:ognl and may be impacted: - info.kfgodel:bean2bean =1.1.5, =0.8, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.1 - net.sf.tacos:tapdoc 0.7.0 - net.sf.tacos:tapdoc-maven-plugin 0.7....

org.apache.mina:mina-example (2.0.0-m1), org.apache.mina:mina-integration-jmx (2.0.0-m1) +13 more potentially affected by CVE-2016-3093 via ognl:ognl (2.7.1)

ognl:ognl MAVEN version 2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on ognl:ognl and may be impacted: - org.apache.mina:mina-example 2.0.0-m1 - org.apache.mina:mina-integration-jmx 2.0.0-m1 - org.apache.mina:mina-integration-ognl 2.0.0-m1 -...

net.sf.click:click-extras (>=1.5.2, <=1.5.3), net.sf.click:click-mock (>=1.5.2, <=1.5.3) +20 more potentially affected by CVE-2016-3093 via ognl:ognl (2.7.2)

ognl:ognl MAVEN version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on ognl:ognl and may be impacted: - net.sf.click:click-extras =1.5.2, =1.5.2, =1.5.2, =1.3.0, =2.0.0-m2, =2.0.0-m2, =2.0.0-m2, =1.3.0, =0.8.0, =0.8.4 and more Source cves:...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), br.com.caelum.vraptor:vraptor-form (4.0.0) +860 more potentially affected by CVE-2016-3093 via ognl:ognl (>=3.0, <=3.0.11)

ognl:ognl MAVEN version =3.0, =1.0.0, =2.0.0, =1.2.4, =1.4, =0.4, =1.4, =0.0.10, =0.2.11, =1.0.0, =1.0.1 - ch.mfrey.thymeleaf.extras.with:thymeleaf-with-dialect 2.0.0 and more Source cves: CVE-2016-3093 Source advisory: GHSA-383P-XQXX-RRMP...

Security Bulletin: IBM Sterling Order Management is affected by Apache Struts 2 security vulnerabilities (CVE-2016-3093 , CVE-2016-4436)

Summary IBM Sterling Order Management uses Apache Struts 2 and is affected by some of the vulnerabilities that exist in Apache Struts 2 Vulnerability Details CVEID: CVE-2016-3093 DESCRIPTION: Apache Struts is vulnerable to a denial of service, caused by the improper implementation of cache used t...

SOL23432135 - Apache Struts 2 vulnerability CVE-2016-3093

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

CVE-2016-3093

Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service block access to a web site via unspecified vectors...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8) +232 more potentially affected by CVE-2016-3093 via org.apache.struts:struts2-core (>=2.0.5, <=2.3.24.1)

org.apache.struts:struts2-core MAVEN version =2.0.5, =2.0.0, =1.2.1, =1.5.3, =1.5.3, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =1.0, =1.0, =1.0, =1.0, =1.0.4 and more Source cves: CVE-2016-3093 Source advisory: MEND:CVE-2016-3093...

CVE-2016-3093

CVE-2016-3093 affects Apache Struts 2.0.0–2.3.24.1. The vulnerability is due to improper caching of method references when OGNL is used, enabling a remote attacker to cause a denial of service (block access to a website). Several connected advisories corroborate the issue and label the impact as ...