Path traversal in Apache Struts - CVE-2016-6795
Published: October 18, 2016 / Updated: March 21, 2018
Vulnerability identifier: #VU1027
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2016-6795
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Apache Foundation
Affected software:
Apache Struts
Apache Struts
Detailed vulnerability description
The vulnerability allows a remote unauthenticated user to execute arbitrary code on the target system.
The weakness is due to insufficient input validation. By submitting a specially crafted URL, attackers can perform a path traversal attack that may lead to arbitrary code execution.
Successful exploitation of the vulnerability resuts in arbitrary code execution on the vulnerable system.
The weakness is due to insufficient input validation. By submitting a specially crafted URL, attackers can perform a path traversal attack that may lead to arbitrary code execution.
Successful exploitation of the vulnerability resuts in arbitrary code execution on the vulnerable system.
How to mitigate CVE-2016-6795
Update to version 2.3.31.