CVE-2016-4438

published 2016-07-04

CVE-2016-4438: The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.

Priority P2 65 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
apache	struts	—	—
apache	struts	—	—
apache	struts	—	—
apache	struts	—	—
apache	struts	—	—
apache	struts	—	—
apache	struts	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Arbitrary code execution is possible by passing a malicious expression to the REST Plugin in Apache Struts 2 (versions 2.3.19 through 2.3.28.1); monitor and inspect REST plugin request payloads for crafted OGNL/expression-language content. ↗
• → Refer to the Apache Struts S2-037 advisory for detailed attack vector and payload patterns associated with this CVE. ↗

• · Affected versions are Apache Struts 2 REST plugin from 2.3.19 through 2.3.28.1 inclusive; scan deployed environments for struts2-core jars within this range, including those bundled in source packages. ↗
• · struts2-core jars may be present in build artifacts derived from Red Hat Fuse Service Works 6.0.0 or Single Sign On 7.3.0+ source packages; use 'find . -name struts2*.jar' to locate and remove them. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vendor_redhat 9.8 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20