CVE-2016-4461

Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785.
References
Link Resource
http://www.securityfocus.com/bid/91277 Third Party Advisory VDB Entry
https://security.netapp.com/advisory/ntap-20180629-0004/ Third Party Advisory
https://struts.apache.org/docs/s2-036.html Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-10-16 16:29

Updated : 2024-02-04 19:29


NVD link : CVE-2016-4461

Mitre link : CVE-2016-4461

CVE.ORG link : CVE-2016-4461


JSON object : View

Products Affected

apache

  • struts

netapp

  • oncommand_balance
CWE
CWE-20

Improper Input Validation