CVE-2016-3093 — Improper Input Validation in Project Ognl

CWE-20 — Improper Input Validation6 documents6 sources
Severity
5.3MEDIUMNVD
EPSS
5.1%
top 10.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Ognl Project OgnlApache Struts
Timeline
PublishedJun 7
Latest updateMay 17

Description

Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDapache/struts55 versions+54
▶NVDognl_project/ognl3.0.11

🔴Vulnerability Details

3
GHSA
Denial of service in Apache Struts↗2022-05-17
▶
OSV
Denial of service in Apache Struts↗2022-05-17
▶
CVEList
CVE-2016-3093: Apache Struts 2↗2016-06-07
▶

📋Vendor Advisories

1
Red Hat
struts: OGNL cache poisoning can lead to DoS↗2016-05-31
▶

💬Community

1
Bugzilla
CVE-2016-3093 struts: OGNL cache poisoning can lead to DoS↗2016-06-01
▶
CVE-2016-3093 — Improper Input Validation | cvebase