Description
Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.
Remediation
References
http://struts.apache.org/docs/s2-029.html
http://www.securityfocus.com/bid/85066
http://www.securitytracker.com/id/1035271
Related Vulnerabilities
CVE-2022-29247 Vulnerability in maven package org.webjars.npm:electron
CVE-2022-24948 Vulnerability in maven package org.apache.jspwiki:jspwiki-main
CVE-2023-0100 Vulnerability in maven package org.eclipse.birt:org.eclipse.birt.report.viewer
CVE-2023-51075 Vulnerability in maven package cn.hutool:hutool-core
CVE-2021-21349 Vulnerability in maven package com.thoughtworks.xstream:xstream