CVE-2016-3090

Published: Oct 30, 2017Modified: May 13, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.

Affected (59)

Products: Apache: Struts

Apache

1 product

Struts

Configuration A

59 vulnerable

Vulnerable Software	Affected Versions
Apache Struts	Version 2.0.10
Apache Struts	Version 2.0.11.1
Apache Struts	Version 2.0.11.2
Apache Struts	Version 2.0.11
Apache Struts	Version 2.0.12
Apache Struts	Version 2.0.13
Apache Struts	Version 2.0.14
Apache Struts	Version 2.0.1
Apache Struts	Version 2.0.2
Apache Struts	Version 2.0.3
Apache Struts	Version 2.0.4
Apache Struts	Version 2.0.5
Apache Struts	Version 2.0.6
Apache Struts	Version 2.0.7
Apache Struts	Version 2.0.8
Apache Struts	Version 2.0.9
Apache Struts	Version 2.1.0
Apache Struts	Version 2.1.1
Apache Struts	Version 2.1.2
Apache Struts	Version 2.1.3
Apache Struts	Version 2.1.4
Apache Struts	Version 2.1.5
Apache Struts	Version 2.1.6
Apache Struts	Version 2.1.7
Apache Struts	Version 2.1.8.1
Apache Struts	Version 2.1.8
Apache Struts	Version 2.2.1.1
Apache Struts	Version 2.2.1
Apache Struts	Version 2.2.3.1
Apache Struts	Version 2.2.3
Apache Struts	Version 2.3.1.1
Apache Struts	Version 2.3.1.2
Apache Struts	Version 2.3.10
Apache Struts	Version 2.3.11
Apache Struts	Version 2.3.12
Apache Struts	Version 2.3.13
Apache Struts	Version 2.3.14.1
Apache Struts	Version 2.3.14.2
Apache Struts	Version 2.3.14.3
Apache Struts	Version 2.3.14
Apache Struts	Version 2.3.15.1
Apache Struts	Version 2.3.15.2
Apache Struts	Version 2.3.15.3
Apache Struts	Version 2.3.15
Apache Struts	Version 2.3.16.1
Apache Struts	Version 2.3.16.2
Apache Struts	Version 2.3.16.3
Apache Struts	Version 2.3.16
Apache Struts	Version 2.3.17
Apache Struts	Version 2.3.19
Apache Struts	Version 2.3.1
Apache Struts	Version 2.3.3
Apache Struts	Version 2.3.4.1
Apache Struts	Version 2.3.4
Apache Struts	Version 2.3.5
Apache Struts	Version 2.3.6
Apache Struts	Version 2.3.7
Apache Struts	Version 2.3.8
Apache Struts	Version 2.3.9