CVE-2016-0785
HighSummary
Apache Struts 2.x before version 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, known as forced double OGNL evaluation.
Risk Assessment
Exploitation of this vulnerability could lead to complete system compromise, allowing attackers to execute arbitrary commands on the server.
Recommendation
It is recommended to upgrade to Apache Struts version 2.3.28 or later to mitigate the risk associated with this vulnerability.
Other vulnerabilities in Apache Struts 2.x
See all- CVE-2016-3090High
The TextParseUtil.translateVariables method in Apache Struts 2.x before version 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression using ANTLR tooling.
- CVE-2016-4461High
Apache Struts 2.x before version 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, known as forced double OGNL evaluation.
- CVE-2017-9804High
In Apache Struts versions 2.3.7 through 2.3.33 and 2.5 through 2.5.12, it is possible to prepare a special URL that can overload the server process during URL validation in a form. This issue exists due to an incomplete fix for S2-047 / CVE-2017-7672.
- CVE-2015-5209High
Apache Struts 2.x before version 2.3.24.1 allows remote attackers to manipulate Struts internals, which may lead to altering user sessions or affecting container settings.
- CVE-2017-9787High
Using Spring AOP functionality to secure Struts actions can lead to a DoS attack.
- CVE-2016-4433High
Apache Struts 2 versions 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.
- CVE-2016-4431High
Apache Struts 2 versions 2.3.20 through 2.3.28.1 allow remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.
- CVE-2016-4430High
Apache Struts 2 versions 2.3.20 through 2.3.28.1 mishandle token validation, allowing remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
- CVE-2016-3081High
Apache Struts versions 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
- CVE-2015-1831High
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to compromise internal state of an application via unspecified vectors.
Original NVD description (English source)
Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.