CVE-2016-6795
At a glance Severity Not available EPSS EPSS 8.22 % · percentile 95 (2026-10-27) State PUBLISHED Published 2017-09-20 Updated 2024-09-17 Assigner apache NVD status Modified Description In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.
Scores Version Score Vector Scored by CVSS 3.0 CRITICAL 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary) CVSS 2.0 HIGH 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
Advisories
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.20.2:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.21:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.22:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.23:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.24.2:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.25:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.26:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.27:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.28.1:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.29:*:*:*:*:*:*:*cpe:2.3:a:apache:struts:2.3.30:*:*:*:*:*:*:*Affected products
References
Sources
