CVE-2016-4438: Input Validation
It was found that it is possible to pass a malicious expression which can be used to execute arbitrary code on server side when using the REST Plugin.
External References:
https://struts.apache.org/docs/s2-037.html
Other sources
The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4438?
CVE-2016-4438 is rated as high severity due to its potential to allow remote code execution on the server.
How do I fix CVE-2016-4438?
To fix CVE-2016-4438, upgrade the Apache Struts REST plugin to version 2.3.29 or later.
What versions are affected by CVE-2016-4438?
CVE-2016-4438 affects Apache Struts versions from 2.3.19 to 2.3.28.
What is the nature of the vulnerability in CVE-2016-4438?
CVE-2016-4438 allows the execution of arbitrary code on the server side through malicious expressions in the REST plugin.
Is my application vulnerable to CVE-2016-4438 if I am using Apache Struts?
Your application is vulnerable to CVE-2016-4438 if it uses the affected versions of the Apache Struts REST plugin or core.