Recent Vulnerabilities Discussions Trends About Contact

By Relevance

By Risk Score

By Publish Date

By Recent Activity

7.5

CVSSv2

Published: 20/09/2017 Updated: 12/08/2019

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

In the Convention plugin in Apache Struts 2.3.x prior to 2.3.31, and 2.5.x prior to 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.

Vendor	Product	Versions
Apache	Struts	2.3.20, 2.3.20.1, 2.3.20.2, 2.3.20.3, 2.3.21, 2.3.22, 2.3.23, 2.3.24, 2.3.24.1, 2.3.24.2, 2.3.24.3, 2.3.25, 2.3.26, 2.3.27, 2.3.28, 2.3.28.1, 2.3.29, 2.3.30

CWE-22 http://www.securityfocus.com/bid/93773 https://security.netapp.com/advisory/ntap-20180629-0003/https://struts.apache.org/docs/s2-042.html http://tools.cisco.com/security/center/viewAlert.x?alertId=49315 https://nvd.nist.gov

Home Recent Vulnerabilities Discussions Trends About Contact

CVE-2016-6795

Vulnerability Summary

Affected Products

References