CVE-2016-4438 : The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attacke

The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.

Published 2016-07-04 22:59:09

Updated 2025-04-12 10:46:41

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2016-4438

Apache » Struts » Version: 2.3.20
cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*
Matching versions
Apache » Struts » Version: 2.3.20.1
cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*
Matching versions
Apache » Struts » Version: 2.3.24
cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:*
Matching versions
Apache » Struts » Version: 2.3.24.1
cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:*
Matching versions
Apache » Struts » Version: 2.3.20.3
cpe:2.3:a:apache:struts:2.3.20.3:*:*:*:*:*:*:*
Matching versions
Apache » Struts » Version: 2.3.28
cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*
Matching versions
Apache » Struts » Version: 2.3.24.3
cpe:2.3:a:apache:struts:2.3.24.3:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

68.83%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

http://jvndb.jvn.jp/jvndb/JVNDB-2016-000110

JVNDB-2016-000110 - JVN iPedia - 脆弱性対策情報データベース
VDB Entry;Vendor Advisory
http://jvn.jp/en/jp/JVN07710476/index.html

JVN#07710476: Apache Struts 2 vulnerable to remote code execution
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1348238

1348238 – (CVE-2016-4438) CVE-2016-4438 struts: Possible RCE via REST plugin
Issue Tracking;Third Party Advisory;VDB Entry
https://struts.apache.org/docs/s2-037.html

S2-037 - DEPRECATED: Apache Struts 2 Documentation - Apache Software Foundation
Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Oracle Critical Patch Update - July 2017

CVEs referencing this url
http://www.securityfocus.com/bid/91275

Apache Struts CVE-2016-4438 Remote Code Execution Vulnerability
Third Party Advisory

Jump to