Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2016-4436

Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.

VectorNETWORK

PublishedOct 03, 2016, 15:59

Published Bysecalert@redhat.com

Base Score

Score9.8

Package (Ecosystem)IntroducedFixedLimit

org.apache.struts:struts2-core(Maven)2.0.02.3.29N/A

org.apache.struts:struts2-core(Maven)2.5-BETA12.5.1N/A

NVD-CWE-noinfo

Base Score

9.8

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.0

Attack Vector (AV)

NETWORK