logo

Database

Lack of data validation In org.apache.struts:struts2-parent

Description

Apache Struts RCE Vulnerability The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2016-30902. NVD-2016-30903. OSV-2016-30904. GHSA-ggmp-fxfg-277r5. GCVE-2016-3090

References

1. https://security.netapp.com/advisory/ntap-20180629-00052. https://struts.apache.org/docs/s2-027.html3. https://web.archive.org/web/20210123095942/http://www.securityfocus.com/bid/851314. https://web.archive.org/web/20211206100940/https://www.securitytracker.com/id/10352675. https://security.netapp.com/advisory/ntap-20180629-0005/

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.