VIR Vulnerability Intelligence Relay

CVE-2016-4461

high
Published 2017-10-16 · Modified 2025-04-23
CVSS v3
8.8
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2
9.0
VIR risk
8.8

Description

Apache Struts forced double OGNL evaluation

Predictions

Exploit likelihood
92%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — https://struts.apache.org/docs/s2-036.html

Package impact
EcosystemPackageVulnerableFixed
java Mavenorg.apache.struts:struts2-core>=2.0.0,<2.3.292.3.29

Application impact
VendorProductVersionsFixed
apache apachestruts{"startIncluding":"2.0.0","endExcluding":"2.3.29"}2.3.29
netapponcommand_balance-

References

CWEs

CWE-20

Verify integrity in audit chain (admin only). AS-IS.