Cloudanix VulnDB

CVE-2016-3082

Critical · 9.8

CVSS

9.8

EPSS

19.2%

Published

Apr 26, 2016

CISA due date

—

The record

XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.

Affected packages

Ecosystem Package Introduced Fixed
Maven org.apache.struts:struts2-core 0 2.3.20.3
Maven org.apache.struts:struts2-core 2.3.24 2.3.24.3
Maven org.apache.struts:struts2-core 2.3.28 2.3.28.1
maven org.apache.struts/struts2-core 2.0.0 No fix
maven org.apache.struts/struts2-core 2.0.12 No fix
maven org.apache.struts/struts2-core 2.1.0 No fix
maven org.apache.struts/struts2-core 2.1.8 No fix
maven org.apache.struts/struts2-core 2.2.1 No fix
maven org.apache.struts/struts2-core 2.2.3 No fix
maven org.apache.struts/struts2-core 2.3.1 No fix
maven org.apache.struts/struts2-core 2.3.12 No fix
maven org.apache.struts/struts2-core 2.3.14 No fix
maven org.apache.struts/struts2-core 2.3.15 No fix
maven org.apache.struts/struts2-core 2.3.16 No fix
maven org.apache.struts/struts2-core 2.3.20 No fix
maven org.apache.struts/struts2-core 2.3.24 No fix
maven org.apache.struts/struts2-core 2.3.28 No fix
maven org.apache.struts/struts2-core 2.3.3 No fix
maven org.apache.struts/struts2-core 2.3.7 No fix

Related vulnerabilities