What is GHSA-pvm9-288c-v5wq?

GHSA-pvm9-288c-v5wq is a security advisory published by GitHub Security Advisories with Critical severity. Remote Code Execution in Apache Struts

Which CVE IDs does GHSA-pvm9-288c-v5wq cover?

GHSA-pvm9-288c-v5wq covers the following CVE IDs: CVE-2016-3082. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pvm9-288c-v5wq?

GHSA-pvm9-288c-v5wq has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-pvm9-288c-v5wq?

GHSA-pvm9-288c-v5wq affects 3 products, including: maven/org.apache.struts:struts2-core:\u003c 2.3.20.3; maven/org.apache.struts:struts2-core:\u003e= 2.3.24, \u003c 2.3.24.3; maven/org.apache.struts:struts2-core:\u003e= 2.3.28, \u003c 2.3.28.1.

GHSA-pvm9-288c-v5wqCriticalCVSS 9.8

Remote Code Execution in Apache Struts

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

December 28, 2023

🔗 CVE IDs covered (1)

CVE-2016-3082 →

📋 Description

XSLTResult allows for the location of a stylesheet being passed as a request parameter. In some circumstances this can be used to inject remotely executable code.

🎯 Affected products3

maven/org.apache.struts:struts2-core:< 2.3.20.3
maven/org.apache.struts:struts2-core:>= 2.3.24, < 2.3.24.3
maven/org.apache.struts:struts2-core:>= 2.3.28, < 2.3.28.1

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2016-3082
http://struts.apache.org/docs/s2-031.html
https://github.com/advisories/GHSA-pvm9-288c-v5wq