CVE-2016-3093
Dashboard / Vulnerabilities / CVE-2016-3093
Summary:
Details: Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.
References: http://www-01.ibm.com/support/docview.wss?uid=swg21987854, http://www.securityfocus.com/bid/90961, http://www.securitytracker.com/id/1036018, https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E, http://struts.apache.org/docs/s2-034.html
Affected packages
Package
Name:
Purl:
Affected ranges
Type: GIT
Events:
Introduced- 2c0a197cea8fdc7d8cda5eeaa15a1c76507ac0a5
Fixed -None
Affected versions
2.0.0
2.0.1
2.0.10
2.0.11
2.0.11.1
2.0.11.2
2.0.12
2.0.13
2.0.14
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
