CVE-2016-6795
high-risk
Published 2017-09-20
In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.
Do I need to act?
~
5.0% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10
Critical
NETWORK
/ LOW complexity
Affected Products (18)
Affected Vendors
References (6)
Third Party Advisory
http://www.securityfocus.com/bid/93773
Vendor Advisory
https://struts.apache.org/docs/s2-042.html
Third Party Advisory
http://www.securityfocus.com/bid/93773
Vendor Advisory
https://struts.apache.org/docs/s2-042.html
59
/ 100
high-risk
Severity
32/34 · Critical
Exploitability
8/34 · Low
Exposure
19/34 · Moderate