Path traversal in Apache Struts - CVE-2016-6795
Published: October 18, 2016 / Updated: March 21, 2018
Vulnerability identifier: #VU1027
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-6795
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote unauthenticated user to execute arbitrary code on the target system.
The weakness is due to insufficient input validation. By submitting a specially crafted URL, attackers can perform a path traversal attack that may lead to arbitrary code execution.
Successful exploitation of the vulnerability resuts in arbitrary code execution on the vulnerable system.
The weakness is due to insufficient input validation. By submitting a specially crafted URL, attackers can perform a path traversal attack that may lead to arbitrary code execution.
Successful exploitation of the vulnerability resuts in arbitrary code execution on the vulnerable system.
Affected software
Apache Struts
How to mitigate CVE-2016-6795
Update to version 2.3.31.