What is GHSA-876p-4wgc-75rx?

GHSA-876p-4wgc-75rx is a security advisory published by GitHub Security Advisories with High severity. Apache Struts RCE Vulnerability

Which CVE IDs does GHSA-876p-4wgc-75rx cover?

GHSA-876p-4wgc-75rx covers the following CVE IDs: CVE-2016-0785. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-876p-4wgc-75rx?

GHSA-876p-4wgc-75rx has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-876p-4wgc-75rx?

GHSA-876p-4wgc-75rx affects 2 products, including: maven/org.apache.struts:struts2-core:\u003e= 2.0.0, \u003c 2.3.20.3; maven/org.apache.struts:struts2-core:\u003e= 2.3.24, \u003c 2.3.24.3.

GHSA-876p-4wgc-75rxHighCVSS 8.8

Apache Struts RCE Vulnerability

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

December 28, 2023

🔗 CVE IDs covered (1)

CVE-2016-0785 →

📋 Description

Apache Struts 2.x before 2.3.20.3, 2.3.24.3, and 2.3.28 allows remote attackers to execute arbitrary code via a %{} sequence in a tag attribute, aka forced double OGNL evaluation.

🎯 Affected products2

maven/org.apache.struts:struts2-core:>= 2.0.0, < 2.3.20.3
maven/org.apache.struts:struts2-core:>= 2.3.24, < 2.3.24.3

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2016-0785
http://struts.apache.org/docs/s2-029.html
https://web.archive.org/web/20210123095715/http://www.securityfocus.com/bid/85066
https://web.archive.org/web/20220118185853/http://www.securitytracker.com/id/1035271
https://github.com/apache/struts/commit/15857a69e7baf3675804495a5954cd0756ac8364
https://github.com/advisories/GHSA-876p-4wgc-75rx