CVE-2016-3082: Input Validation
XSLTResult allows for the location of a stylesheet being passed as a request parameter. In some circumstances this can be used to inject remotely executable code.
Other sources
XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.
— NVD
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3082?
CVE-2016-3082 is classified as a critical vulnerability that allows remote code execution in affected Apache Struts versions.
How do I fix CVE-2016-3082?
To fix CVE-2016-3082, upgrade to Apache Struts version 2.3.28.1 or later, or apply the relevant patches for earlier versions.
Which versions of Apache Struts are affected by CVE-2016-3082?
CVE-2016-3082 affects Apache Struts versions prior to 2.3.20.2, 2.3.24.2, and 2.3.28.1.
How can I determine if my application is vulnerable to CVE-2016-3082?
Check if your application is using any versions of Apache Struts earlier than 2.3.28.1, as those are vulnerable to CVE-2016-3082.
What type of attack can be executed via CVE-2016-3082?
CVE-2016-3082 can be exploited to inject remotely executable code leading to potential remote code execution attacks.