Description
Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.
Remediation
References
http://struts.apache.org/docs/s2-029.html
http://www.securityfocus.com/bid/85066
http://www.securitytracker.com/id/1035271
Related Vulnerabilities
CVE-2022-38370 Vulnerability in maven package org.apache.iotdb:iotdb-grafana-connector
CVE-2022-39249 Vulnerability in npm package matrix-js-sdk
CVE-2022-45395 Vulnerability in maven package com.thalesgroup.jenkins-ci.plugins:cccc
CVE-2022-0686 Vulnerability in npm package url-parse
CVE-2023-46120 Vulnerability in maven package com.rabbitmq:amqp-client