Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: redhat
Published: 2017-10-16T16:00:00
Updated: 2024-08-06T00:32:25.387Z
Reserved: 2016-05-02T00:00:00
Link: CVE-2016-4461
Vulnrichment
No data.
NVD
Status : Modified
Published: 2017-10-16T16:29:00.607
Modified: 2024-11-21T02:52:15.757
Link: CVE-2016-4461
Redhat
No data.