Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2016-3082

XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.

VectorNETWORK

PublishedApr 26, 2016, 14:59

Published Bysecalert@redhat.com

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.apache.struts:struts2-core(Maven)02.3.20.3N/A

org.apache.struts:struts2-core(Maven)2.3.242.3.24.3N/A

org.apache.struts:struts2-core(Maven)2.3.282.3.28.1N/A

References

http://struts.apache.org/docs/s2-031.html
http://www.securityfocus.com/bid/88826
http://www.securitytracker.com/id/1035664

Weakness Type

CWE-20

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.0

Attack Vector (AV)

NETWORK