CVE-2016-6795
CriticalSummary
The Convention plugin in Apache Struts versions 2.3.x before 2.3.31 and 2.5.x before 2.5.5 allows for the preparation of a special URL that can be used for path traversal and execution of arbitrary code on the server side.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to the system and execute malicious code, potentially leading to serious security implications for the organization.
Recommendation
It is recommended to update Apache Struts to version 2.3.31 or 2.5.5 and conduct a security audit of the application to minimize risk.
Original NVD description (English source)
In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.