CVE-2016-6795

2016-10-1800:00:00

apache

www.cve.org

9.6 High

AI Score

Confidence

High

0.02 Low

EPSS

Percentile

89.0%

JSON

In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.

CNA Affected

[
  {
    "product": "Apache Struts",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "2.3.x before 2.3.31"
      },
      {
        "status": "affected",
        "version": "2.5.x before 2.5.5"
      }
    ]
  }
]