PT-2016-2303 · Apache · Apache Struts 2+1
Adam Mariš
·
Publicado
2016-07-04
·
Atualizado
2022-05-17
·
CVE-2016-4433
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Struts 2 versions 2.3.20 through 2.3.28.1
Description
The issue allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request. This is due to insufficient input validation in the Apache Struts platform. Exploitation of the issue may enable a remote attacker to bypass existing access restrictions using a specially crafted request.
Recommendations
For Apache Struts 2 versions 2.3.20 through 2.3.28.1, update to a version outside of this range to resolve the issue.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Struts
Apache Struts 2