Struts Security Vulnerabilities and Issues — Struts CVE List

Lucene search

ApacheStruts

2 matches found

CVE•added 2017/10/16 4:29 p.m.•58 views

CVE-2016-4461

Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785.

9CVSS8.8AI score0.33397EPSS

CVE•added 2017/10/30 2:29 p.m.•46 views

CVE-2016-3090

The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.

8.8CVSS8.7AI score0.02858EPSS