Apache Struts RCE Vulnerability
High severity
GitHub Reviewed
Published
May 14, 2022
to the GitHub Advisory Database
•
Updated Nov 1, 2023
Package
Affected versions
>= 2.3.19, <= 2.3.20.2
>= 2.3.25, <= 2.3.28
>= 2.3.21, <= 2.3.24.2
Patched versions
2.3.20.3
2.3.28.1
2.3.24.3
Description
Published by the National Vulnerability Database
Apr 26, 2016
Published to the GitHub Advisory Database
May 14, 2022
Reviewed
Jul 28, 2023
Last updated
Nov 1, 2023
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
References