Cloudanix VulnDB

CVE-2016-4438

Critical · 9.8

CVSS

9.8

EPSS

16.7%

Published

Jul 4, 2016

CISA due date

—

The record

The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.

Affected packages

Ecosystem Package Introduced Fixed
Maven org.apache.struts:struts2-core 2.3.19 2.3.29
Maven org.apache.struts:struts2-rest-plugin 2.3.19 2.3.29
maven org.apache.struts/struts2-rest-plugin 2.3.20 No fix
maven org.apache.struts/struts2-rest-plugin 2.3.20.3 No fix
maven org.apache.struts/struts2-rest-plugin 2.3.24 No fix
maven org.apache.struts/struts2-rest-plugin 2.3.24.3 No fix
maven org.apache.struts/struts2-rest-plugin 2.3.28 No fix

Related vulnerabilities