Arbitrary code execution in Apache Struts 2

严重 9.8CVE-2016-4438 · GHSA-4prj-vw9j-v6pr · Published 04/07/2016 · updated 17/06/2026

要点

CVE-2016-4438 是影响 org.apache.struts:struts2-core, org.apache.struts:struts2-rest-plugin, struts (apache) 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：16.7%，高于 97.0% 的漏洞。
修复：升级到 2.3.29 或更高版本。

Package	Affected versions	Patched versions
org.apache.struts:struts2-core Maven	`≥ 2.3.19, < 2.3.29`	`2.3.29`
org.apache.struts:struts2-rest-plugin Maven	`≥ 2.3.19, < 2.3.29`	`2.3.29`
struts apache	`= 2.3.20= 2.3.20.1= 2.3.20.3= 2.3.24= 2.3.24.1= 2.3.24.3= 2.3.28`	No fix yet

The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.

NVD description

The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Maven

≥ 2.3.19, < 2.3.29

2.3.29

Maven

≥ 2.3.19, < 2.3.29

2.3.29

= 2.3.20= 2.3.20.1= 2.3.20.3= 2.3.24= 2.3.24.1= 2.3.24.3= 2.3.28

No fix yet

org.apache.struts:struts2-core 的其他漏洞

查看全部 →