medium5.3
CVE-2016-3093
Denial of service in Apache Struts
Impact
Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.struts:struts2-core | >= 2.0.0, <= 2.3.24.1 | 2.3.24.3 |
| maven | ognl:ognl | < 3.0.12 | 3.0.12 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ognl Project | Ognl | through 3.0.11 |
| Apache | Struts | Versions 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://struts.apache.org/docs/s2-034.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21987854
- http://www.securityfocus.com/bid/90961
- http://www.securitytracker.com/id/1036018
- https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E
- https://github.com/advisories/GHSA-383p-xqxx-rrmp
- https://nvd.nist.gov/vuln/detail/CVE-2016-3093
- https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E
- https://struts.apache.org/docs/s2-034.html