Vulmon Recent Vulnerabilities Trends About Contact
7.5
CVSSv2

CVE-2016-6795

Published: 20/09/2017 Updated: 12/08/2019
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Subscribe to Struts

Vulnerability Summary

In the Convention plugin in Apache Struts 2.3.x prior to 2.3.31, and 2.5.x prior to 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.

Affected Products

Vendor Product Versions
ApacheStruts2.3.20, 2.3.20.1, 2.3.20.2, 2.3.20.3, 2.3.21, 2.3.22, 2.3.23, 2.3.24, 2.3.24.1, 2.3.24.2, 2.3.24.3, 2.3.25, 2.3.26, 2.3.27, 2.3.28, 2.3.28.1, 2.3.29, 2.3.30

References

CWE-22http://www.securityfocus.com/bid/93773https://security.netapp.com/advisory/ntap-20180629-0003/https://struts.apache.org/docs/s2-042.htmlhttp://tools.cisco.com/security/center/viewAlert.x?alertId=49315https://nvd.nist.gov
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2020-1630CVE-2020-0674CVE-2018-21038bypassCVE-2020-1987CVE-2020-1988insecure direct object referencerace conditionCVE-2020-6819