CVE-2016-3082 - Vulnerability Details

Vendors	Products
Apache	Struts

Link	Providers
http://struts.apache.org/docs/s2-031.html
http://www.securityfocus.com/bid/88826
http://www.securitytracker.com/id/1035664
https://nvd.nist.gov/vuln/detail/CVE-2016-3082
https://struts.apache.org/docs/s2-031.html
https://www.cve.org/CVERecord?id=CVE-2016-3082

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-04-19T00:00:00", "descriptions": [{"lang": "en", "value": "XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-11-25T19:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "88826", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/88826"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://struts.apache.org/docs/s2-031.html"}, {"name": "1035664", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1035664"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2016-3082", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "88826", "refsource": "BID", "url": "http://www.securityfocus.com/bid/88826"}, {"name": "http://struts.apache.org/docs/s2-031.html", "refsource": "CONFIRM", "url": "http://struts.apache.org/docs/s2-031.html"}, {"name": "1035664", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1035664"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T23:40:15.634Z"}, "title": "CVE Program Container", "references": [{"name": "88826", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/88826"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://struts.apache.org/docs/s2-031.html"}, {"name": "1035664", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1035664"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2016-3082", "datePublished": "2016-04-26T14:00:00", "dateReserved": "2016-03-10T00:00:00", "dateUpdated": "2024-08-05T23:40:15.634Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : n/a (string)

vendor : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

}

]

}

]

datePublic : 2016-04-19T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : n/a (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2016-11-25T19:57:01 (string)

orgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

shortName : redhat (string)

}

references : [ »

0 : { »

name : 88826 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

]

url : http://www.securityfocus.com/bid/88826 (string)

}

1 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : http://struts.apache.org/docs/s2-031.html (string)

}

2 : { »

name : 1035664 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_SECTRACK (string)

]

url : http://www.securitytracker.com/id/1035664 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : secalert@redhat.com (string)

ID : CVE-2016-3082 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : n/a (string)

version : { »

version_data : [ »

0 : { »

version_value : n/a (string)

}

]

}

]

}

vendor_name : n/a (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : n/a (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : 88826 (string)

refsource : BID (string)

url : http://www.securityfocus.com/bid/88826 (string)

}

1 : { »

name : http://struts.apache.org/docs/s2-031.html (string)

refsource : CONFIRM (string)

url : http://struts.apache.org/docs/s2-031.html (string)

}

2 : { »

name : 1035664 (string)

refsource : SECTRACK (string)

url : http://www.securitytracker.com/id/1035664 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-05T23:40:15.634Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

name : 88826 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

2 : x_transferred (string)

]

url : http://www.securityfocus.com/bid/88826 (string)

}

1 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : http://struts.apache.org/docs/s2-031.html (string)

}

2 : { »

name : 1035664 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_SECTRACK (string)

2 : x_transferred (string)

]

url : http://www.securitytracker.com/id/1035664 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

assignerShortName : redhat (string)

cveId : CVE-2016-3082 (string)

datePublished : 2016-04-26T14:00:00 (string)

dateReserved : 2016-03-10T00:00:00 (string)

dateUpdated : 2024-08-05T23:40:15.634Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "5CF11DCF-6F6E-4E18-988E-E43918FBB8A6", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "BE3A90B7-C632-4D3E-9A4F-21E46D273B42", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "386538BE-F258-4870-8E11-750ADA228026", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "B4CF15B9-3714-4206-9971-1F7D59E20483", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "DFA32D87-65C7-4589-86B7-500BE3203CFA", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "98C3FB11-4E24-4067-A3A9-021F849DAAE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "4DCF2D72-90F1-4D1B-94A2-5BB3D8C086C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "661F1610-9FCD-4FC1-BCA1-69C58E0A1389", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "D9C89E22-B106-4EAB-90A1-0EA86C165737", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:*", "matchCriteriaId": "6E1BABB2-780E-47E0-87A9-A164906C8421", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "AC32348E-7EF4-411C-9A44-CD041ABFA0E2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:*", "matchCriteriaId": "94BD452B-AE41-4F7A-9DB9-4B1039582537", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:*", "matchCriteriaId": "ACFDC53B-7B8E-4333-BC87-E01024EC9C21", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:*", "matchCriteriaId": "9F0818E7-B617-4C30-BFAC-9FE2F375F8BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:*", "matchCriteriaId": "50F4A58E-F3D4-4711-A37E-EA538B112371", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:*", "matchCriteriaId": "EFFCC96F-FD87-4495-B8A5-19D7898D5662", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:*", "matchCriteriaId": "DEA0424E-84B4-41BD-8E6C-93E2A77DD6CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "CEC53AE5-3640-4FE1-B0B1-EA26C5B9EB9B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "662A2E4B-A76A-4498-98A6-F90DF65C62B7", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "4E720B3A-4CFB-47FE-B80C-67C59D4C7FD4", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "CA687B56-A09B-4741-84F1-2BD9569A3F76", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "0BC0E358-8B4D-480B-BFAE-966CB697310A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:*", "matchCriteriaId": "2B7E8E1C-C667-4AED-86A5-2BD0C62AAD76", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:*", "matchCriteriaId": "88B3348C-1086-4A16-97E3-52DB65FF860A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:*", "matchCriteriaId": "3C65711D-9C5B-4644-A12D-82243CB6FB1E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:*", "matchCriteriaId": "FC1FA9A7-2C8E-4651-9400-190198528642", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "FA9093C0-AE6A-4285-B159-8FDBF37E33D7", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "267A1C33-1C95-41DA-8A01-6F20C7BE1772", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "7E4590B9-6A44-4DC6-B7DF-5E6CAAA9D25A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "30860683-D403-4D24-B356-FD306AEFCA46", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "4E3316DA-9E34-4955-91CA-E35B141A7007", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "0D152B29-FAD5-4DEA-B187-278EBD37FEB4", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "2AC68463-F500-471C-8600-8F8FD9743B12", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "A92AAE08-4811-465A-8178-25F5F349B8BA", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "B487975D-6394-4136-B45C-C1F209465B24", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "BDC41957-8CCA-46A6-BD31-4039EEF3C457", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:*", "matchCriteriaId": "443B4E64-2A36-49C6-B09D-77B3BDF69709", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:*", "matchCriteriaId": "2481505C-4FD1-4195-9E10-9DD741498FB2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:*", "matchCriteriaId": "28ED63DB-2AAF-4BC9-A844-074EDF63C89A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:*", "matchCriteriaId": "38A6CEED-6C43-4325-B36C-9F254CCDFDC0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:*", "matchCriteriaId": "41F43088-26AA-4890-A9D6-1B9B48D5F02A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:*", "matchCriteriaId": "BE6820E3-8FDF-4BDF-8B62-E604A91F1280", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:*", "matchCriteriaId": "D25ED06A-F12C-443E-9B3F-FDDF52FE9D93", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:*", "matchCriteriaId": "44527919-8403-42A8-9CE1-3B4F58630F34", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:*", "matchCriteriaId": "EBB91D8A-14B8-4263-B90D-F776535F9B8F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:*", "matchCriteriaId": "FB525941-7175-43C1-9F17-814F5F7C72CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:*", "matchCriteriaId": "F10D559E-04A0-4002-947C-D3902138795B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:*", "matchCriteriaId": "89203DD8-2C95-4546-9504-83654FFA5DBC", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:*", "matchCriteriaId": "EB3D5644-CFAC-4FB5-A1FB-387F97876098", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:*", "matchCriteriaId": "1225A0B0-C3F2-4579-BFE9-F8DB2CF596F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:*", "matchCriteriaId": "8DC883A7-0766-4857-ABC8-9DB4BA713650", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*", "matchCriteriaId": "22FF6282-0BCA-46EB-9648-6EE3EDA189F2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:*", "matchCriteriaId": "6D1467BC-9BC8-402D-A420-615CF9698648", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:*", "matchCriteriaId": "524C5119-416D-413B-BF1D-29291E23FDB2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:*", "matchCriteriaId": "45446B16-F531-4C6D-B889-A8A6622C70A2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:*", "matchCriteriaId": "C778ADED-75B5-4AD3-8CDC-EFDFFAD5A742", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter."}, {"lang": "es", "value": "XSLTResult en Apache Struts 2.x en versiones anteriores a 2.3.20.2, 2.3.24.x en versiones anteriores a 2.3.24.2 y 2.3.28.x en versiones anteriores a 2.3.28.1 permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s del par\u00e1metro de hoja de c\u00e1lculo location."}], "id": "CVE-2016-3082", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-04-26T14:59:03.190", "references": [{"source": "secalert@redhat.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://struts.apache.org/docs/s2-031.html"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/88826"}, {"source": "secalert@redhat.com", "url": "http://www.securitytracker.com/id/1035664"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://struts.apache.org/docs/s2-031.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/88826"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1035664"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 5CF11DCF-6F6E-4E18-988E-E43918FBB8A6 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:* (string)

matchCriteriaId : BE3A90B7-C632-4D3E-9A4F-21E46D273B42 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:apache:struts:2.0.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 386538BE-F258-4870-8E11-750ADA228026 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:apache:struts:2.0.3:*:*:*:*:*:*:* (string)

matchCriteriaId : B4CF15B9-3714-4206-9971-1F7D59E20483 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:apache:struts:2.0.4:*:*:*:*:*:*:* (string)

matchCriteriaId : DFA32D87-65C7-4589-86B7-500BE3203CFA (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:apache:struts:2.0.5:*:*:*:*:*:*:* (string)

matchCriteriaId : 98C3FB11-4E24-4067-A3A9-021F849DAAE3 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:apache:struts:2.0.6:*:*:*:*:*:*:* (string)

matchCriteriaId : 4DCF2D72-90F1-4D1B-94A2-5BB3D8C086C2 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:apache:struts:2.0.7:*:*:*:*:*:*:* (string)

matchCriteriaId : 661F1610-9FCD-4FC1-BCA1-69C58E0A1389 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:apache:struts:2.0.8:*:*:*:*:*:*:* (string)

matchCriteriaId : D9C89E22-B106-4EAB-90A1-0EA86C165737 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:apache:struts:2.0.9:*:*:*:*:*:*:* (string)

matchCriteriaId : 6E1BABB2-780E-47E0-87A9-A164906C8421 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:apache:struts:2.0.10:*:*:*:*:*:*:* (string)

matchCriteriaId : AC32348E-7EF4-411C-9A44-CD041ABFA0E2 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:apache:struts:2.0.11:*:*:*:*:*:*:* (string)

matchCriteriaId : 94BD452B-AE41-4F7A-9DB9-4B1039582537 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:apache:struts:2.0.11.1:*:*:*:*:*:*:* (string)

matchCriteriaId : ACFDC53B-7B8E-4333-BC87-E01024EC9C21 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:apache:struts:2.0.11.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 9F0818E7-B617-4C30-BFAC-9FE2F375F8BD (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:apache:struts:2.0.12:*:*:*:*:*:*:* (string)

matchCriteriaId : 50F4A58E-F3D4-4711-A37E-EA538B112371 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:apache:struts:2.0.13:*:*:*:*:*:*:* (string)

matchCriteriaId : EFFCC96F-FD87-4495-B8A5-19D7898D5662 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:apache:struts:2.0.14:*:*:*:*:*:*:* (string)

matchCriteriaId : DEA0424E-84B4-41BD-8E6C-93E2A77DD6CA (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:apache:struts:2.1.0:*:*:*:*:*:*:* (string)

matchCriteriaId : CEC53AE5-3640-4FE1-B0B1-EA26C5B9EB9B (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:apache:struts:2.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 662A2E4B-A76A-4498-98A6-F90DF65C62B7 (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:apache:struts:2.1.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 4E720B3A-4CFB-47FE-B80C-67C59D4C7FD4 (string)

vulnerable : true (boolean)

}

20 : { »

criteria : cpe:2.3:a:apache:struts:2.1.3:*:*:*:*:*:*:* (string)

matchCriteriaId : CA687B56-A09B-4741-84F1-2BD9569A3F76 (string)

vulnerable : true (boolean)

}

21 : { »

criteria : cpe:2.3:a:apache:struts:2.1.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 0BC0E358-8B4D-480B-BFAE-966CB697310A (string)

vulnerable : true (boolean)

}

22 : { »

criteria : cpe:2.3:a:apache:struts:2.1.5:*:*:*:*:*:*:* (string)

matchCriteriaId : 2B7E8E1C-C667-4AED-86A5-2BD0C62AAD76 (string)

vulnerable : true (boolean)

}

23 : { »

criteria : cpe:2.3:a:apache:struts:2.1.6:*:*:*:*:*:*:* (string)

matchCriteriaId : 88B3348C-1086-4A16-97E3-52DB65FF860A (string)

vulnerable : true (boolean)

}

24 : { »

criteria : cpe:2.3:a:apache:struts:2.1.8:*:*:*:*:*:*:* (string)

matchCriteriaId : 3C65711D-9C5B-4644-A12D-82243CB6FB1E (string)

vulnerable : true (boolean)

}

25 : { »

criteria : cpe:2.3:a:apache:struts:2.1.8.1:*:*:*:*:*:*:* (string)

matchCriteriaId : FC1FA9A7-2C8E-4651-9400-190198528642 (string)

vulnerable : true (boolean)

}

26 : { »

criteria : cpe:2.3:a:apache:struts:2.2.1:*:*:*:*:*:*:* (string)

matchCriteriaId : FA9093C0-AE6A-4285-B159-8FDBF37E33D7 (string)

vulnerable : true (boolean)

}

27 : { »

criteria : cpe:2.3:a:apache:struts:2.2.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 267A1C33-1C95-41DA-8A01-6F20C7BE1772 (string)

vulnerable : true (boolean)

}

28 : { »

criteria : cpe:2.3:a:apache:struts:2.2.3:*:*:*:*:*:*:* (string)

matchCriteriaId : 7E4590B9-6A44-4DC6-B7DF-5E6CAAA9D25A (string)

vulnerable : true (boolean)

}

29 : { »

criteria : cpe:2.3:a:apache:struts:2.2.3.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 30860683-D403-4D24-B356-FD306AEFCA46 (string)

vulnerable : true (boolean)

}

30 : { »

criteria : cpe:2.3:a:apache:struts:2.3.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 4E3316DA-9E34-4955-91CA-E35B141A7007 (string)

vulnerable : true (boolean)

}

31 : { »

criteria : cpe:2.3:a:apache:struts:2.3.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 0D152B29-FAD5-4DEA-B187-278EBD37FEB4 (string)

vulnerable : true (boolean)

}

32 : { »

criteria : cpe:2.3:a:apache:struts:2.3.1.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 2AC68463-F500-471C-8600-8F8FD9743B12 (string)

vulnerable : true (boolean)

}

33 : { »

criteria : cpe:2.3:a:apache:struts:2.3.3:*:*:*:*:*:*:* (string)

matchCriteriaId : A92AAE08-4811-465A-8178-25F5F349B8BA (string)

vulnerable : true (boolean)

}

34 : { »

criteria : cpe:2.3:a:apache:struts:2.3.4:*:*:*:*:*:*:* (string)

matchCriteriaId : B487975D-6394-4136-B45C-C1F209465B24 (string)

vulnerable : true (boolean)

}

35 : { »

criteria : cpe:2.3:a:apache:struts:2.3.4.1:*:*:*:*:*:*:* (string)

matchCriteriaId : BDC41957-8CCA-46A6-BD31-4039EEF3C457 (string)

vulnerable : true (boolean)

}

36 : { »

criteria : cpe:2.3:a:apache:struts:2.3.7:*:*:*:*:*:*:* (string)

matchCriteriaId : 443B4E64-2A36-49C6-B09D-77B3BDF69709 (string)

vulnerable : true (boolean)

}

37 : { »

criteria : cpe:2.3:a:apache:struts:2.3.8:*:*:*:*:*:*:* (string)

matchCriteriaId : 2481505C-4FD1-4195-9E10-9DD741498FB2 (string)

vulnerable : true (boolean)

}

38 : { »

criteria : cpe:2.3:a:apache:struts:2.3.12:*:*:*:*:*:*:* (string)

matchCriteriaId : 28ED63DB-2AAF-4BC9-A844-074EDF63C89A (string)

vulnerable : true (boolean)

}

39 : { »

criteria : cpe:2.3:a:apache:struts:2.3.14:*:*:*:*:*:*:* (string)

matchCriteriaId : 38A6CEED-6C43-4325-B36C-9F254CCDFDC0 (string)

vulnerable : true (boolean)

}

40 : { »

criteria : cpe:2.3:a:apache:struts:2.3.14.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 41F43088-26AA-4890-A9D6-1B9B48D5F02A (string)

vulnerable : true (boolean)

}

41 : { »

criteria : cpe:2.3:a:apache:struts:2.3.14.2:*:*:*:*:*:*:* (string)

matchCriteriaId : BE6820E3-8FDF-4BDF-8B62-E604A91F1280 (string)

vulnerable : true (boolean)

}

42 : { »

criteria : cpe:2.3:a:apache:struts:2.3.14.3:*:*:*:*:*:*:* (string)

matchCriteriaId : D25ED06A-F12C-443E-9B3F-FDDF52FE9D93 (string)

vulnerable : true (boolean)

}

43 : { »

criteria : cpe:2.3:a:apache:struts:2.3.15:*:*:*:*:*:*:* (string)

matchCriteriaId : 44527919-8403-42A8-9CE1-3B4F58630F34 (string)

vulnerable : true (boolean)

}

44 : { »

criteria : cpe:2.3:a:apache:struts:2.3.15.1:*:*:*:*:*:*:* (string)

matchCriteriaId : EBB91D8A-14B8-4263-B90D-F776535F9B8F (string)

vulnerable : true (boolean)

}

45 : { »

criteria : cpe:2.3:a:apache:struts:2.3.15.2:*:*:*:*:*:*:* (string)

matchCriteriaId : FB525941-7175-43C1-9F17-814F5F7C72CA (string)

vulnerable : true (boolean)

}

46 : { »

criteria : cpe:2.3:a:apache:struts:2.3.15.3:*:*:*:*:*:*:* (string)

matchCriteriaId : F10D559E-04A0-4002-947C-D3902138795B (string)

vulnerable : true (boolean)

}

47 : { »

criteria : cpe:2.3:a:apache:struts:2.3.16:*:*:*:*:*:*:* (string)

matchCriteriaId : 89203DD8-2C95-4546-9504-83654FFA5DBC (string)

vulnerable : true (boolean)

}

48 : { »

criteria : cpe:2.3:a:apache:struts:2.3.16.1:*:*:*:*:*:*:* (string)

matchCriteriaId : EB3D5644-CFAC-4FB5-A1FB-387F97876098 (string)

vulnerable : true (boolean)

}

49 : { »

criteria : cpe:2.3:a:apache:struts:2.3.16.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 1225A0B0-C3F2-4579-BFE9-F8DB2CF596F6 (string)

vulnerable : true (boolean)

}

50 : { »

criteria : cpe:2.3:a:apache:struts:2.3.16.3:*:*:*:*:*:*:* (string)

matchCriteriaId : 8DC883A7-0766-4857-ABC8-9DB4BA713650 (string)

vulnerable : true (boolean)

}

51 : { »

criteria : cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:* (string)

matchCriteriaId : 22FF6282-0BCA-46EB-9648-6EE3EDA189F2 (string)

vulnerable : true (boolean)

}

52 : { »

criteria : cpe:2.3:a:apache:struts:2.3.20.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 6D1467BC-9BC8-402D-A420-615CF9698648 (string)

vulnerable : true (boolean)

}

53 : { »

criteria : cpe:2.3:a:apache:struts:2.3.24:*:*:*:*:*:*:* (string)

matchCriteriaId : 524C5119-416D-413B-BF1D-29291E23FDB2 (string)

vulnerable : true (boolean)

}

54 : { »

criteria : cpe:2.3:a:apache:struts:2.3.24.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 45446B16-F531-4C6D-B889-A8A6622C70A2 (string)

vulnerable : true (boolean)

}

55 : { »

criteria : cpe:2.3:a:apache:struts:2.3.28:*:*:*:*:*:*:* (string)

matchCriteriaId : C778ADED-75B5-4AD3-8CDC-EFDFFAD5A742 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter. (string)

}

1 : { »

lang : es (string)

value : XSLTResult en Apache Struts 2.x en versiones anteriores a 2.3.20.2, 2.3.24.x en versiones anteriores a 2.3.24.2 y 2.3.28.x en versiones anteriores a 2.3.28.1 permite a atacantes remotos ejecutar código arbitrario a través del parámetro de hoja de cálculo location. (string)

}

]

id : CVE-2016-3082 (string)

lastModified : 2025-04-12T10:46:40.837 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : HIGH (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : COMPLETE (string)

baseScore : 10 (number)

confidentialityImpact : COMPLETE (string)

integrityImpact : COMPLETE (string)

vectorString : AV:N/AC:L/Au:N/C:C/I:C/A:C (string)

version : 2.0 (string)

}

exploitabilityScore : 10 (number)

impactScore : 10 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.0 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2016-04-26T14:59:03.190 (string)

references : [ »

0 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : http://struts.apache.org/docs/s2-031.html (string)

}

1 : { »

source : secalert@redhat.com (string)

url : http://www.securityfocus.com/bid/88826 (string)

}

2 : { »

source : secalert@redhat.com (string)

url : http://www.securitytracker.com/id/1035664 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : http://struts.apache.org/docs/s2-031.html (string)

}

4 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : http://www.securityfocus.com/bid/88826 (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : http://www.securitytracker.com/id/1035664 (string)

}

]

sourceIdentifier : secalert@redhat.com (string)

vulnStatus : Deferred (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-20 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Show plain JSON

{"bugzilla": {"description": "Struts2: XSLTResult can be used to parse arbitrary stylesheet (S2-031)", "id": "1331019", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1331019"}, "csaw": false, "cvss": {"cvss_base_score": "6.8", "cvss_scoring_vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "status": "draft"}, "details": ["XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter."], "name": "CVE-2016-3082", "package_state": [{"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Not affected", "package_name": "struts", "product_name": "Red Hat JBoss Enterprise Web Server 1"}], "public_date": "2016-04-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2016-3082\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-3082\nhttps://struts.apache.org/docs/s2-031.html"], "statement": "A previous statement by Red Hat related to this CVE, prior to August 2019, said that Apache Struts 2 is not included in any Red Hat products. This earlier statement was incorrect. While Struts 2 is not actively compiled, shipped, used, or enabled in any Red Hat provided final products, and does not cause any vulnerability in the product, struts2-core jars have been included in some products' source code packages. The inclusion was part of an import of the Google Guice repository, which includes struts2-core. Customers that build artefacts from our source code could be at risk. Red Hat will remove these artefacts from source code in future releases.\nThe products that included the Struts 2 artefacts in their source jars:\nFuse Service Works 6.0.0\nSingle Sign On 7.3.0+\nIf you have used the source package from one of these products to build artefacts on your system, you should do the following to remove potentially affected jars:\n1. Run 'find . -name struts2*.jar' under the source location\n2. Remove any files found\nThis will not affect the product, as the jar is included with the source of google-guice, but no functionality requiring struts2 is implemented.", "threat_severity": "Important"}

{

bugzilla : { »

description : Struts2: XSLTResult can be used to parse arbitrary stylesheet (S2-031) (string)

id : 1331019 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=1331019 (string)

}

csaw : false (boolean)

cvss : { »

cvss_base_score : 6.8 (string)

cvss_scoring_vector : AV:N/AC:M/Au:N/C:P/I:P/A:P (string)

status : draft (string)

}

details : [ »

0 : XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter. (string)

]

name : CVE-2016-3082 (string)

package_state : [ »

0 : { »

cpe : cpe:/a:redhat:jboss_enterprise_web_server:1 (string)

fix_state : Not affected (string)

package_name : struts (string)

product_name : Red Hat JBoss Enterprise Web Server 1 (string)

}

]

public_date : 2016-04-26T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2016-3082 https://nvd.nist.gov/vuln/detail/CVE-2016-3082 https://struts.apache.org/docs/s2-031.html (string)

]

statement : A previous statement by Red Hat related to this CVE, prior to August 2019, said that Apache Struts 2 is not included in any Red Hat products. This earlier statement was incorrect. While Struts 2 is not actively compiled, shipped, used, or enabled in any Red Hat provided final products, and does not cause any vulnerability in the product, struts2-core jars have been included in some products' source code packages. The inclusion was part of an import of the Google Guice repository, which includes struts2-core. Customers that build artefacts from our source code could be at risk. Red Hat will remove these artefacts from source code in future releases. The products that included the Struts 2 artefacts in their source jars: Fuse Service Works 6.0.0 Single Sign On 7.3.0+ If you have used the source package from one of these products to build artefacts on your system, you should do the following to remove potentially affected jars: 1. Run 'find . -name struts2*.jar' under the source location 2. Remove any files found This will not affect the product, as the jar is included with the source of google-guice, but no functionality requiring struts2 is implemented. (string)

threat_severity : Important (string)

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object