CVE-2016-3082 (High) detected in struts2-core-2.3.1.2.jar

[mend-for-github-com]

CVE-2016-3082 - High Severity Vulnerability

Vulnerable Library - struts2-core-2.3.1.2.jar

Apache Struts 2

Path to dependency file: /tmp/ws-scm/Struts2Example/pom.xml

Path to vulnerable library: 20200325141938/downloadResource_d50070f4-1279-48e5-8366-a2fcdc735d7c/20200325145151/struts2-core-2.3.1.2.jar

Dependency Hierarchy:

• ❌ struts2-core-2.3.1.2.jar (Vulnerable Library)

Found in HEAD commit: 20d7b6df1b42979ec0033b63405d552a70d92b0c

Vulnerability Details

XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.

Publish Date: 2016-04-26

URL: CVE-2016-3082

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-3082

Release Date: 2016-04-26

Fix Resolution: 2.3.20.2,2.3.24.2,2.3.28.1