What is GHSA-4prj-vw9j-v6pr?

GHSA-4prj-vw9j-v6pr is a security advisory published by GitHub Security Advisories with Critical severity. Arbitrary code execution in Apache Struts 2

Which CVE IDs does GHSA-4prj-vw9j-v6pr cover?

GHSA-4prj-vw9j-v6pr covers the following CVE IDs: CVE-2016-4438. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4prj-vw9j-v6pr?

GHSA-4prj-vw9j-v6pr has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-4prj-vw9j-v6pr?

GHSA-4prj-vw9j-v6pr affects 2 products, including: maven/org.apache.struts:struts2-core:\u003e= 2.3.19, \u003c 2.3.29; maven/org.apache.struts:struts2-rest-plugin:\u003e= 2.3.19, \u003c 2.3.29.

GHSA-4prj-vw9j-v6prCriticalCVSS 9.8

Arbitrary code execution in Apache Struts 2

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

December 28, 2023

🔗 CVE IDs covered (1)

CVE-2016-4438 →

📋 Description

The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.

🎯 Affected products2

maven/org.apache.struts:struts2-core:>= 2.3.19, < 2.3.29
maven/org.apache.struts:struts2-rest-plugin:>= 2.3.19, < 2.3.29

🔗 References (10)

https://nvd.nist.gov/vuln/detail/CVE-2016-4438
https://bugzilla.redhat.com/show_bug.cgi?id=1348238
https://struts.apache.org/docs/s2-037.html
http://jvn.jp/en/jp/JVN07710476/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000110
https://github.com/apache/struts/commit/6d7ac40dcede1793a4534a3dc249fd562d495e8c
https://github.com/apache/struts/commit/76eb8f38a33ad0f1f48464ee1311559c8d52dd6d
https://github.com/apache/struts/commit/c9c21378f2fb2ff21355c128c45e106ebd87ad7c
https://github.com/apache/struts/commit/deefeffd11425f0cd0b797cd86a9b3550234262b
https://github.com/advisories/GHSA-4prj-vw9j-v6pr